How Long Until a Deleted Passkey Stops Working?

A passkey can stop working immediately—usually on the next sign-in attempt—if it is removed from the website or app account that registered it. Once the service deletes its server-side credential record, it should reject future authentication attempts made with that passkey.

Deleting a passkey only from a phone, computer, security key, or password manager is different. That copy may become unavailable immediately on that device, but a synchronized copy may still exist elsewhere, and the website may continue listing the passkey until it is also removed from the account’s security settings. Existing signed-in sessions may remain active as well.

The practical answer ranges from seconds to the next successful synchronization, depending on where the deletion occurred and what the user means by “stop working.”

Quick Answer

Removing a passkey from a website’s account settings normally revokes it as soon as the service confirms the change, so it should fail at the next authentication attempt. Removing it only from a device or credential manager usually prevents that stored copy from signing in immediately, but it does not necessarily remove the website’s public-key record or other copies. A synchronized manager may propagate the deletion to online devices within seconds or minutes, but there is no universal deadline, and an offline device cannot receive a change until it reconnects. Deleting a passkey also does not automatically sign out sessions that were authenticated earlier.

Typical Passkey Deletion Timelines

What was deleted?	When that passkey may stop working	What may remain
Passkey removed from the website or app account	Usually immediately after confirmation; rejected on the next authentication attempt	A local copy may still appear on a device or in a manager
Device-bound passkey deleted from that device	Immediately on that device	The website’s registered public key and other separately created passkeys
Passkey deleted from a synchronized credential manager	Usually immediately in the current manager; other online devices update when sync completes	Offline devices, another manager, a separate passkey, and the website’s record
Passkey deleted from Apple Passwords	Removed from normal active use; recoverable for up to 30 days unless permanently deleted sooner	The website’s registration may remain until removed there
Passkey removed from a Google Account’s sign-in methods	Invalidated for that Google Account after removal	A third-party manager may still display its local copy and other sign-in methods remain
Windows device-bound passkey deleted in Settings	Immediately unavailable from that Windows credential store	The account registration and passkeys in other providers
Passkey on a hardware security key deleted or the key reset	Immediately unavailable from that security key	The service may still list the credential until it is deregistered
One of several passkeys removed	That credential stops working when properly revoked or deleted	Other registered passkeys can continue working
Passkey deleted while the account is already signed in	Future passkey authentication is affected	Existing session cookies or tokens may remain active
Lost device merely disconnected or powered off	It is temporarily unavailable	The passkey is not revoked and may work again when the device returns

These are practical expectations, not guaranteed service-level deadlines. Passkey managers, operating systems, websites, and organizational policies do not all implement deletion and synchronization identically.

Why “Delete the Passkey” Can Mean Three Different Things

The largest source of confusion is that a passkey exists as a relationship between a user-controlled authenticator and a service. There are several places where something can be deleted.

1. Delete the Private-Key Credential From a Device or Manager

The user removes the passkey from Apple Passwords, Google Password Manager, Microsoft Password Manager, Windows, a third-party password manager, or a hardware security key.

That action removes or disables the credential that can produce the cryptographic signature. The device or manager should no longer offer that copy for authentication. However, the website may still retain the corresponding public key and credential ID in its account database.

The website’s leftover record is not enough to sign in. A public key can verify a signature, but it cannot create the private-key signature required for authentication. The record may nevertheless remain visible in the account’s passkey list until it is removed.

2. Delete the Passkey Registration From the Website or App

The user opens the service’s security settings and removes a listed passkey. The service deletes or disables its server-side credential record. Future assertions signed by that credential should be rejected.

This is the action that revokes the passkey’s authority for that particular account. It does not automatically reach into every device or credential manager and erase the private-key copy. Google’s passkey design guidance explicitly distinguishes the two sides: when a service removes the public key from its server, the private key is not necessarily deleted from the user’s device or credential manager.

3. End Existing Signed-In Sessions

A passkey authenticates the user at sign-in or during a sensitive reauthentication. After successful authentication, many services establish a separate session represented by a cookie or token.

Deleting the passkey may prevent the next passkey login while leaving an existing session active. To end access that has already been granted, the user may also need to:

sign out of the current session
use a “sign out of all devices” or “manage sessions” control
revoke trusted devices or application tokens
remove a lost device from the account
change recovery or security settings when compromise is suspected

Whether a service automatically cancels sessions after passkey removal is a service-specific security decision. It should not be assumed.

How a Passkey Works Before It Is Deleted

A passkey uses public-key cryptography rather than a shared password.

During registration:

The authenticator creates a unique credential for the website or app.
The private-key capability remains under the control of the authenticator or credential provider.
The public key and a credential identifier are sent to the service.
The service stores the public-key credential record with the user’s account.

During sign-in:

The service sends a fresh challenge.
The browser or operating system locates an eligible passkey.
The user approves the operation by unlocking the device or credential manager.
The authenticator signs the challenge with the private key.
The service verifies the signature with the stored public key.

The fingerprint, face scan, device PIN, or password-manager unlock method is used locally to authorize the authenticator. The website does not receive a copy of the user’s biometric data.

Deletion breaks this flow on one side or the other. Removing the credential from the authenticator prevents it from making a valid assertion. Removing the public-key record from the service prevents the service from accepting an assertion from that credential.

What Happens When You Delete a Passkey From the Website?

This is normally the fastest and most decisive way to make a particular passkey stop authorizing access to that account.

The Web Authentication specification describes server-side decommissioning directly: a user selects a registered credential, the server deletes it from its database, and future assertions from that credential are rejected. There is no built-in waiting period required by WebAuthn.

The practical sequence is usually:

The user opens the account’s password, sign-in, or security settings.
The service may require recent authentication.
The user selects the correct passkey and confirms removal.
The service updates its credential database.
The removed credential fails the next time it is presented.

If the security page displays a successful removal message, the change is usually effective immediately. Network failure, an unsaved confirmation, a stale browser page, or a service error can prevent completion, so a user handling a lost device should verify that the passkey no longer appears in the account.

Why the Deleted Passkey May Still Appear on the Device

The website cannot always delete a private credential from a user’s authenticator. A password manager may continue showing the entry, or a browser may continue offering it at sign-in.

If the user selects that orphaned passkey, the authenticator can produce a signature, but the service should reject it because the matching server record is gone.

WebAuthn Level 3 includes methods that allow a relying party to signal that a credential is unknown or provide a list of credentials still accepted for an account. Compatible authenticators may then hide or remove stale credentials. That improves cleanup, but support and timing can vary, and an authenticator may not be connected when the signal is sent.

The important security result occurs on the server: once the credential is deregistered, the stale local copy should no longer grant account access.

What Happens When You Delete a Passkey From a Device?

A device-bound passkey should become unavailable from that device as soon as the local deletion succeeds. The WebAuthn specification describes this case as one in which the credential no longer appears in selection prompts and no assertions can be generated with it.

The website may not be notified. It may continue showing the passkey as registered because its public-key record still exists. That record is harmless by itself, but leaving it behind creates clutter and uncertainty.

For a complete cleanup, remove the credential in both places:

the device, security key, or credential manager where it was stored
the website or app account where it was registered

Microsoft gives this two-location instruction for work and school passkeys: delete the method from the account’s security information and from the place where it was saved, such as Windows Hello.

Device-Bound Does Not Mean Every Passkey on the Device

A device may contain credentials from several providers. Windows can store a local device-bound passkey while a browser extension or password manager offers a synchronized passkey for the same service. Deleting the Windows copy does not necessarily delete the manager’s separate credential.

Likewise, resetting a hardware security key removes credentials on that key but does not automatically revoke the corresponding records at every service. Each affected account should be reviewed.

What Happens With a Synced Passkey?

A synced passkey is made available through a passkey provider across authorized devices in the same ecosystem or account. Examples include iCloud Keychain, Google Password Manager, Microsoft Password Manager, and compatible third-party password managers.

When a user deletes the passkey through that provider, the deletion may synchronize to other connected devices. The current device usually reflects the change immediately. Other online devices may update quickly, but no universal standard promises a particular number of seconds or minutes.

Timing can be affected by:

whether the other device is online
whether credential synchronization is enabled
whether the correct provider account is signed in
network and cloud-service availability
battery-saving or background-data restrictions
an outdated operating system or credential-manager version
whether the passkey was in a shared group or vault
whether a second, separately created passkey looks similar

An offline device cannot receive a synchronized deletion until it reconnects. A well-designed provider should reconcile the deleted state rather than treating the old offline state as authoritative, but the user should verify the result after reconnection when security is important.

Syncing Is Not the Same as Creating Several Independent Passkeys

One synchronized passkey available on several devices is not necessarily the same as three passkeys independently registered from three devices. An account security page may list one provider-backed credential, or it may list several separately created credentials with similar names.

Deleting one independently registered passkey does not revoke the others. Users should compare provider, device, creation date, and last-used information when the service supplies it.

How Apple Passwords Handles a Deleted Passkey

Apple’s Passwords app and iCloud Keychain can keep passkeys updated across a user’s compatible Apple devices and supported PCs.

When a passkey is deleted from Apple Passwords, Apple provides a recovery period. Current Apple guidance states that a recently deleted password or passkey can be recovered for 30 days before permanent deletion. Recovering it returns the passkey to the Mac and iCloud Keychain.

That 30-day period does not mean the passkey remains in normal active use for 30 days. It means Apple retains a recoverable deleted item. If the passkey must be revoked because a device was shared, lost, or compromised, the user should also remove it from the website’s account settings. Server-side revocation is what makes that credential unacceptable to the service even if a recoverable or stale local copy exists.

Apple also allows information in the Passwords app to be removed permanently before the recovery period ends. Menu names and available controls can vary by operating-system version.

What If the Passkey Was Shared?

Passkeys and passwords can be placed in shared groups in Apple’s ecosystem. Deleting or stopping the sharing of an item is not always the same as revoking it at the website.

If a credential was accessible to other people, the account owner should:

remove the passkey from the website or app
review the shared group or credential-manager access
create a new passkey under the intended ownership
review account sessions and recovery methods

Changing group membership alone should not be treated as guaranteed account revocation.

How Google Handles Passkey Removal

Google Account Help instructs users to remove a passkey from the Google Account’s Security & sign-in settings under Passkeys and security keys. Google says a passkey associated with a lost device or mistakenly created on a shared device should be invalidated for use with the account.

Some Android passkeys can be automatically registered with the Google Account. Google’s current instructions say that removing an automatically created Android passkey requires removing or signing out the device from the Google Account’s device-management page.

Google also warns about the two-location problem. If a passkey was removed from the Google Account but still appears during sign-in, the user should check the third-party credential manager and remove the saved copy there as well.

Google Password Manager can synchronize passkeys across supported devices. A deletion in the manager therefore needs time to reach connected devices, but Google does not publish one universal deletion-sync deadline for every device, platform, and network condition. It is more accurate to verify the actual state than to promise a fixed number of seconds.

Removing a Google Account passkey does not necessarily remove the account password, recovery methods, or other authentication factors. Those methods have separate controls.

How Windows and Microsoft Handle Passkey Deletion

Windows 11 provides a passkey-management page under Settings > Accounts > Passkeys. Microsoft says a device-bound passkey stored locally in Windows can be deleted there. Once successfully deleted, that Windows store should no longer be able to present the credential.

Microsoft account passkeys can also be removed from the personal account security dashboard or the work or school security-information page. Microsoft’s current guidance distinguishes passkeys saved to Windows from those stored in synchronized credential managers.

For work or school accounts, Microsoft specifically recommends removing the passkey in both locations:

the organization account’s security-information page
the storage location, such as Windows Hello passkeys

An employer or school may restrict passkey controls through administrative policy. The organization may also retain or revoke sessions, devices, and authentication methods through its identity-management system. In that environment, the user may need the help desk when the normal controls are unavailable.

Microsoft also cautions users to add another valid sign-in method before removing a needed passkey. Removing all security information from a personal Microsoft account can trigger a separate restricted-state process; that policy is not a general passkey deletion delay and should not be applied to every service.

What About 1Password and Other Third-Party Managers?

Third-party credential managers reinforce the same distinction. Current 1Password instructions state that deleting a passkey saved in 1Password does not remove it from the account on the website or service. The user must also follow the site’s steps to remove the registered passkey.

A manager can remove its ability to supply the credential, while the website continues showing the public-key registration. Conversely, deleting the passkey on the site may leave an entry in the manager that can be offered but rejected.

Third-party products differ in:

deletion and trash-recovery behavior
synchronization schedules
shared-vault behavior
offline caching
export and migration support
device-approval rules
enterprise retention policies

Users should follow the documentation for the manager that actually stored the passkey. The browser’s pop-up may show more than one provider, so it is important to identify the selected storage location before deleting anything.

Does Deleting a Passkey Sign You Out?

Usually, not by itself.

Authentication and session management are related but separate. The passkey proves identity during a sign-in or reauthentication event. After that, the website commonly issues a session cookie or token so the user does not have to repeat the passkey ceremony on every page.

OWASP’s session-management guidance explains that an authenticated session uses a session identifier to connect later requests to the authenticated user. That token can remain valid until logout, revocation, or a service-defined idle or absolute timeout.

A service can choose to invalidate sessions when a passkey is removed, especially if the action signals compromise. However, WebAuthn does not impose that behavior on every site.

If the goal is to stop access from a lost or untrusted device, take the broader actions offered by the service:

revoke the passkey at the account
sign the lost device out
select “sign out everywhere” when available
remove the device from trusted-device lists
revoke application passwords, refresh tokens, or connected apps when relevant
remotely lock or erase the device through its platform service
review recent account activity

Deleting a passkey is one part of incident response, not a universal remote-logout command.

Can a Deleted Passkey Start Working Again?

It depends on what was deleted and whether it can be recovered.

Recovering a Deleted Credential

Apple allows recovery of a recently deleted passkey for up to 30 days. A password manager with a trash or item-history feature may provide its own recovery option. Restoring the private credential can make it available again only if the website still accepts the matching public-key record.

If the website already revoked the passkey, restoring the local copy should not restore its authority. The user would normally need to register a new passkey with the service.

Re-creating a Passkey

Creating a new passkey is a new registration, not the old passkey magically returning. The new credential has its own cryptographic key pair and credential identifier. A service may give it a similar display name, which can make the change look less obvious.

Reappearing Because Sync Was Incomplete

If a deleted item reappears, possible explanations include:

another device had not synchronized the deletion
the user deleted a different copy
the item was restored from a credential-manager recovery area
several similar passkeys were registered
the website’s account page is stale
a browser is showing a cached passkey identifier
automatic passkey creation registered a new credential after a later sign-in

Do not assume that reappearance proves the original deletion failed. Compare the credential’s provider, device, creation information, and account record when available.

Why a Website May Offer a Passkey That No Longer Works

This is a known lifecycle problem rather than a contradiction.

The local credential manager may know, “I have a passkey for this domain,” while the server knows, “That credential is no longer registered.” The manager offers it, the user approves it, and the server rejects the assertion.

WebAuthn Level 3’s credential-signal methods were designed in part to reduce this mismatch. A site can signal that a credential is unknown after a failed attempt or provide the authenticator with the full list of accepted credential IDs while the user is signed in. The authenticator can remove or hide obsolete entries.

That cleanup may not happen instantly because:

the browser or authenticator may not support the newer signal
the authenticator may not be connected
the user may be on another device
the site may not have implemented the signal
the credential provider may temporarily hide rather than permanently erase the item

The security decision still belongs to the server. A rejected orphaned credential is inconvenient, but it should not regain access merely because it remains visible locally.

How to Confirm That a Passkey No Longer Works

Verification should be deliberate, especially after losing a device.

Check the Website’s Security Page

Sign in from a trusted device and open the service’s official security settings. Confirm that the specific passkey is gone from the registered methods. Look for device, provider, creation date, or last-used information to avoid removing the wrong credential.

Check the Credential Provider

Open the operating system’s passkey settings or the credential manager that stored the passkey. Confirm that the entry is removed, in a deleted-items area, or otherwise unavailable for normal sign-in.

Test From a Signed-Out or Private Context

An already authenticated browser does not prove whether the passkey still works. If testing is safe and another recovery method is available, sign out in a separate browser profile or use a private window and attempt a passkey login.

Do not sign out of the last usable session when there is no verified recovery path. First create and test a replacement passkey or another approved sign-in method.

Review Active Sessions Separately

Open the account’s device or session page. Remove unfamiliar or lost devices and use the global sign-out option when the risk justifies it. A failed passkey test does not prove that previously issued sessions have ended.

Allow a Reconnected Device to Synchronize

If the passkey was synchronized, reconnect other devices, open the credential provider, and give it an opportunity to update. Confirm the item’s actual status rather than relying only on the time elapsed.

What to Do Before Deleting Your Only Passkey

A passkey can be highly secure and still create an account-recovery problem if it is the only working sign-in method.

Before routine deletion:

Check whether the account has another registered passkey.
Confirm that a password, recovery code, approved security key, or account-recovery method works.
Create a replacement passkey when moving to a new device or manager.
Test the replacement from a signed-out context.
Review the labels so the correct old credential is removed.
Delete the old registration from the service.
Delete the old stored copy from its device or provider.
Review active sessions and trusted devices.

For a high-value account, two independent recovery paths are safer than relying on one phone or one cloud account. The appropriate methods depend on the service’s options and the user’s risk level.

What to Do If the Device Was Lost or Stolen

Do not wait for synchronization and do not rely only on the device’s screen lock.

From a trusted device:

Open the affected service’s official account-security page.
Remove the passkey associated with the lost device or provider.
Sign the lost device out and revoke its sessions where possible.
Remotely mark the device lost, lock it, or erase it through the operating-system provider.
Review recent sign-ins, security alerts, and account changes.
Confirm recovery email addresses, phone numbers, codes, and backup methods.
Create a replacement passkey on a controlled device.
Repeat the process for other important accounts that used device-bound credentials.

Passkeys are designed to require local user verification, so possession of a locked device does not automatically give someone access. Nevertheless, a known compromise, weak device PIN, shared unlock code, or already-unlocked device requires prompt action.

Common Passkey Deletion Mistakes

Deleting Only the Manager Entry

This removes the private credential from that manager but may leave the service registration. Clean up both sides.

Deleting Only the Website Entry

This revokes the passkey, but the manager may continue offering a stale copy. Delete or hide the local entry to avoid confusion.

Confusing a Passkey With the Device PIN

The device PIN unlocks the local authenticator. Changing or removing a PIN is not the same as removing every passkey protected by it. Device behavior varies, and disabling screen lock may make passkeys unavailable without revoking them at websites.

Assuming a Password Was Deleted Too

Adding or deleting a passkey does not automatically remove a password or recovery factor unless the service explicitly says it does. Review each authentication method separately.

Removing the Last Method Before Testing a Replacement

This can trigger account recovery or permanent lockout. Create and test the replacement first during a planned migration.

Treating Disconnection as Revocation

Turning off Bluetooth, disabling sync, signing out of a browser, or powering down a device may make a passkey temporarily unavailable. Those actions do not necessarily deregister it at the service.

Forgetting Existing Sessions

A person already signed in may not need the passkey again until the service requests reauthentication. Revoke sessions separately when access must end now.

Why There Is No Universal Deletion Clock

Passkeys are built on an interoperable authentication standard, but the lifecycle around them involves systems outside the core sign-in ceremony:

the relying party’s account database
the authenticator or hardware key
the operating system
a synchronized credential provider
a browser or app
offline devices
shared groups or vaults
session and token systems
enterprise identity policies
recovery and recently deleted features

WebAuthn defines how credentials are registered and used and describes how servers and authenticators can decommission them. It does not require every password manager to synchronize deletion within the same number of seconds or every website to cancel sessions in the same way.

The most reliable answer is therefore based on the boundary that was changed:

Server registration removed: the passkey should be rejected at the next authentication attempt.
Local credential removed: that authenticator should stop generating assertions immediately.
Synced credential removed: the current provider reflects deletion, while other devices depend on synchronization and connectivity.
Session not revoked: access already granted may continue until logout, revocation, or expiration.

Frequently Asked Questions

Does a passkey stop working immediately after I remove it from a website?

Usually, yes. Once the service successfully deletes or disables the registered public-key credential, it should reject that passkey at the next authentication attempt. Verify that the removal was confirmed and that the credential no longer appears in account settings.

Does deleting a passkey from my phone remove it from the website?

Not necessarily. The phone may lose its private credential immediately while the website retains the public-key registration. Remove the passkey from the website’s security settings as well for a complete cleanup.

Does deleting a passkey from a website remove it from my password manager?

Not always. The manager may still show or offer the local credential even though the website will reject it. Some newer systems can receive signals that hide stale credentials, but support and timing vary.

How long does a synced passkey deletion take to reach other devices?

There is no universal deadline. Online devices may update within seconds or minutes, while an offline device cannot receive the deletion until it reconnects. Verify the entry on each important device after synchronization.

Can an offline device still use a passkey that was revoked on the website?

It may still store and display the credential, but it should not be able to authenticate once the website has revoked the matching server record. Authentication requires the service to accept the signed challenge.

Why does my deleted passkey still appear at sign-in?

The local manager may have an orphaned copy, the page may be stale, synchronization may be incomplete, or another similar passkey may exist. Remove the local entry, refresh the account list, and compare provider and device information.

Does deleting a passkey log out every device?

Usually not. Existing sessions use separate cookies or tokens and may continue until they are signed out, revoked, or expired. Use the service’s session or device controls when access must end everywhere.

Can I recover a deleted Apple passkey?

Apple currently allows a recently deleted passkey to be recovered for up to 30 days unless it is permanently removed sooner. Recovery restores the credential to Apple Passwords and iCloud Keychain, but it will not override a website’s server-side revocation.

If I restore a deleted passkey, will it work again?

Only if the website still accepts the matching credential registration. If the service revoked it, restoring the local copy should not make it valid; create and register a new passkey instead.

Does deleting one passkey delete all passkeys for the account?

No. An account can have multiple passkeys from different devices or providers. Removing one credential normally leaves the others available unless the service offers and the user confirms a remove-all action.

Does changing my fingerprint or Face ID delete my passkeys?

Not by itself. Biometrics are local methods for unlocking the authenticator, not the passkey stored by the website. Security behavior after biometric enrollment changes is platform-specific, so check the device provider’s current guidance.

Does deleting a passkey also delete my account password?

Usually not. Passwords, passkeys, recovery codes, security keys, and recovery contacts are separate methods unless the service explicitly combines their controls. Review the account’s complete sign-in-method list.

Can a public key left on a website be used to break into my account?

The public key is designed to verify signatures and cannot create the private-key signature required for sign-in. A leftover registration should still be removed for accurate account management, but the public key alone is not a usable login secret.

Should I delete a passkey before replacing my phone?

Create and test a replacement first. If the passkey is synced through a provider, it may become available on the new phone after the provider is securely restored. For device-bound passkeys, register a new credential, then remove the old one from both the account and old device when possible.

Quick Summary

A passkey usually stops authorizing new sign-ins immediately after the website or app successfully removes its registered credential. A device-bound passkey also becomes unusable from that authenticator as soon as its local deletion succeeds. Synchronized passkeys add another clock: other online devices may update quickly, while offline devices must reconnect before receiving the deletion.

Deleting only one side can leave a confusing remnant. A password manager may display a credential that the website has revoked, or the website may list a public key after the private credential was deleted from a device. For complete cleanup, remove the passkey from both the service and the provider that stored it.

Passkey deletion does not reliably terminate sessions that were authenticated earlier. When a device is lost, stolen, or untrusted, also sign it out, revoke sessions, use remote lock or erase controls, review account activity, and create a tested replacement sign-in method. The safest routine migration is to create and test the replacement before deleting the old passkey.

Sources & References

Editorial Review

Reviewed by Claire Bennett, Managing Editor

Last reviewed: August 2026

Quick Answer Guide publishes practical, research-based answers to common questions about money, technology, health, travel, home improvement, and everyday life. Content is reviewed using official government resources, educational institutions, industry publications, and other authoritative sources when appropriate. Articles are updated periodically to improve accuracy and usefulness.

How Long Does It Take for a Passkey to Stop Working After You Delete It?