What Happens If You Lose Your Passkey?

This MojoAuth blog post explains what happens when a user loses a passkey, contrasting synced (cloud-backed) passkeys that recover via platform accounts with device-bound passkeys that are irrecoverable if the hardware is lost. It covers common loss scenarios, the WebAuthn Backup Eligible (BE) and Backup State (BS) flags used to determine recoverability, and recommends that relying parties enforce a two-credential minimum, store BE/BS and AAGUID metadata, and provide phishing-resistant recovery to avoid lockouts.