Account security in depthDMfirst-owned · Edition 101
Choose a passkey setup you can recover
Passkeys change how a website checks your identity. Understand device-bound and synced credentials, test a second access route, and plan recovery before removing an existing sign-in method.
A password is a secret you type into a page. If the page is a convincing imitation, you can accidentally give that secret to an attacker. Web Authentication, the browser technology behind many passkeys, uses public-key cryptography instead. The service keeps a public key and the authenticator proves possession of the corresponding private key. The authentication is tied to the service's identity rather than to a reusable string that a person must recognize and type correctly.
Before creating a passkey, read the operating system or password manager prompt. Some credentials are stored on a particular device or physical security key. Others can synchronize through a credential provider. These arrangements have different consequences when a phone breaks or a laptop is replaced. Do not assume that a credential created on one device automatically appears on every other device you own.
Navigate to the service using a previously checked address. Open its security settings and look for supported passkey or security-key registration. Confirm the account name before approving the device prompt, especially if the browser contains several signed-in accounts. Give the credential a useful device label if the service permits one, such as personal laptop, rather than a vague description you will forget later.
Imagine the primary device is unavailable. Which device can you use next, and what information would that device require? If the answer includes an email inbox, verify that you can access the inbox independently. If the answer includes backup codes, keep them in a secure location that does not depend entirely on the missing device. Some services permit several registered authenticators; others provide a different recovery route.
A fingerprint or face check may unlock the authenticator locally. That does not mean the website receives your fingerprint image. The browser and authenticator perform a protocol that proves the credential can be used. A PIN may serve a similar local unlocking role, depending on the device and configuration. Read the provider's explanation instead of assuming every biometric prompt operates identically.
Understand the role of biometrics and screen locks06
When you retire a device, review the service's list of registered passkeys and sessions. Remove credentials that are no longer needed after confirming a working replacement. If a device was lost rather than retired normally, use the provider's documented account-security process promptly. Removing a passkey and revoking a signed-in session can be different actions, so check both where the service exposes them.
Review the setup when devices change
No matching sections. Try a different phrase or choose All sections.
Make the reading useful.
Take a moment to check your understanding. This is a reflection aid, not a certification or account check.
Progress is saved only in this browser. No account is created.
