This is the #1 most common misconception I see about passkeys. They do not make it more likely that you will lose access to your accounts. They actually have nothing to do with account recovery. They are just a stronger primary factor than a password.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (there's nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

And if the account recovery scenario in question is your Gmail or Apple account, then you would need to go through their account recovery flows regardless of whether you were using a password or a passkey:

https://support.google.com/accounts/answer/7682439?hl=en https://support.apple.com/en-us/118574