Passkey account recovery: how to design it without a weak back door

Design passkey recovery so it is never weaker than the passkey itself. Let users register more than one passkey, offer a security key as a recovery credential, and treat full account recovery as a high-risk event with notifications and a delay. Do not fall back to SMS or security questions.

Start with the cases that need no recovery

FIDO notes that a user with passkeys on several devices is covered when one is lost, because syncing places the passkey on the others. A user who sets up a new device with the same provider gets their passkeys there too.

So your first job is encouraging a second passkey, ideally on a different device or provider, during or soon after enrollment.

The lost-everything case

FIDO suggests a security key can act as a recovery credential if all synced devices are lost. If none of that is available, FIDO says the relying party can handle it as a normal account recovery.

That last path is where attackers aim. OWASP offers these recovery options for MFA in general:

• single use recovery codes issued at setup
• enrolment of several factor types
• a one time code or replacement token sent to the registered address
• a rigorous support identity check
• vouching by a trusted user

Rules that keep recovery honest

1. No downgrade. OWASP says fallback must not be weaker than the primary method.
2. Re-authenticate after recovery. OWASP says to require re-authentication after a reset or other high-risk event, and to invalidate sessions afterward.
3. Notify on every channel. Tell the user through all registered channels when recovery starts and when it finishes.
4. Add friction on purpose. A waiting period before a recovered account can change email or remove passkeys gives the real owner time to object. This is a design suggestion, not a standard.
5. Never use security questions. OWASP says NIST no longer accepts them as a factor.

For workforce accounts

Route recovery through an administrator with a documented identity check, and log it. Do not let help desk staff reset a privileged account on a phone call alone.

Test recovery the way an attacker would. Create an account with a passkey, then try to take it over using only public information and access to the registered mailbox. If you succeed, so can someone else. Repeat the test with a support agent who has been told a convincing story. Write the result down, fix the weakest step, and run the exercise again after every change to the recovery flow.

Quick check

Sources

• FIDO Alliance, Passkeys
• OWASP Multifactor Authentication Cheat Sheet
• OWASP Authentication Cheat Sheet

Last reviewed: 19 October 2026.