{"id":1436,"date":"2026-10-17T18:00:00","date_gmt":"2026-10-17T17:00:00","guid":{"rendered":"https:\/\/wade.one\/blog\/?p=1436"},"modified":"2026-10-17T18:00:00","modified_gmt":"2026-10-17T17:00:00","slug":"passkeys-still-need-a-sensible-account-recovery-flow","status":"publish","type":"post","link":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/","title":{"rendered":"Passkeys Still Need a Sensible Account Recovery Flow"},"content":{"rendered":"

Passkeys can make signing in feel pleasantly uneventful. I still want to know what happens when somebody loses access to the device or account they normally use. A good login experience should survive an ordinary bit of bad luck without turning recovery into either a security hole or a support nightmare.<\/p>\n

WebAuthn<\/a> gives services a public-key authentication mechanism. That solves an important part of signing in, but it does not define your whole account lifecycle. The product still needs clear decisions about registering another credential, removing an old one and proving ownership when the usual route is unavailable.<\/p>\n

For me, those decisions belong in the design before launch. Make it obvious which sign-in methods are attached, let people prepare another route where the service supports it, and explain what recovery can and cannot do. Avoid asking users to discover an obscure setting only after they are locked out. Recovery should also avoid casually bypassing the protection that made the login secure in the first place.<\/p>\n

The successful version is boring: people understand how to get back in, support knows the limits, and unusual requests have a defined process. “We support passkeys” is a useful feature. “You can still use your account when your phone breaks” is the experience people will remember.<\/p>\n","protected":false},"excerpt":{"rendered":"

Passkeys can make signing in feel pleasantly uneventful.<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[17],"tags":[263,73,262],"class_list":["post-1436","post","type-post","status-publish","format-standard","hentry","category-software","tag-account-recovery","tag-authentication","tag-passkeys"],"yoast_head":"\nPasskeys Still Need a Sensible Account Recovery Flow - wade.one<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Passkeys Still Need a Sensible Account Recovery Flow - wade.one\" \/>\n<meta property=\"og:description\" content=\"Passkeys can make signing in feel pleasantly uneventful.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/\" \/>\n<meta property=\"og:site_name\" content=\"wade.one\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-17T17:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1518\" \/>\n\t<meta property=\"og:image:height\" content=\"1506\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:site\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Passkeys Still Need a Sensible Account Recovery Flow\",\"datePublished\":\"2026-10-17T17:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/\"},\"wordCount\":219,\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"keywords\":[\"account-recovery\",\"authentication\",\"passkeys\"],\"articleSection\":[\"Software\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/\",\"name\":\"Passkeys Still Need a Sensible Account Recovery Flow - wade.one\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\"},\"datePublished\":\"2026-10-17T17:00:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/10\\\/17\\\/passkeys-still-need-a-sensible-account-recovery-flow\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wade.one\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Passkeys Still Need a Sensible Account Recovery Flow\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/\",\"name\":\"wade.one\",\"description\":\"wade womersley - york based software engineer\",\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wade.one\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\",\"name\":\"Wade Womersley\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"contentUrl\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"width\":202,\"height\":200,\"caption\":\"Wade Womersley\"},\"logo\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Passkeys Still Need a Sensible Account Recovery Flow - wade.one","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/","og_locale":"en_GB","og_type":"article","og_title":"Passkeys Still Need a Sensible Account Recovery Flow - wade.one","og_description":"Passkeys can make signing in feel pleasantly uneventful.","og_url":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/","og_site_name":"wade.one","article_published_time":"2026-10-17T17:00:00+00:00","og_image":[{"width":1518,"height":1506,"url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_creator":"@wadewomersley","twitter_site":"@wadewomersley","twitter_misc":{"Estimated reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/#article","isPartOf":{"@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/"},"author":{"name":"","@id":""},"headline":"Passkeys Still Need a Sensible Account Recovery Flow","datePublished":"2026-10-17T17:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/"},"wordCount":219,"publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"keywords":["account-recovery","authentication","passkeys"],"articleSection":["Software"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/","url":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/","name":"Passkeys Still Need a Sensible Account Recovery Flow - wade.one","isPartOf":{"@id":"https:\/\/wade.one\/blog\/#website"},"datePublished":"2026-10-17T17:00:00+00:00","breadcrumb":{"@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/wade.one\/blog\/2026\/10\/17\/passkeys-still-need-a-sensible-account-recovery-flow\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wade.one\/blog\/"},{"@type":"ListItem","position":2,"name":"Passkeys Still Need a Sensible Account Recovery Flow"}]},{"@type":"WebSite","@id":"https:\/\/wade.one\/blog\/#website","url":"https:\/\/wade.one\/blog\/","name":"wade.one","description":"wade womersley - york based software engineer","publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wade.one\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3","name":"Wade Womersley","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","contentUrl":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","width":202,"height":200,"caption":"Wade Womersley"},"logo":{"@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1251,"url":"https:\/\/wade.one\/blog\/2026\/05\/03\/the-vercel-incident-is-a-reminder-that-ai-tools-are-supply-chain-risk\/","url_meta":{"origin":1436,"position":0},"title":"The Vercel Incident Is a Reminder That AI Tools Are Supply Chain Risk","author":"","date":"May 3, 2026","format":false,"excerpt":"AI tools are now part of the software supply chain. That means they need the same security scrutiny as any other tool with access to systems and secrets.","rel":"","context":"In "AI"","block_context":{"text":"AI","link":"https:\/\/wade.one\/blog\/category\/ai\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1173,"url":"https:\/\/wade.one\/blog\/2026\/04\/06\/most-mobile-app-complexity-is-not-in-the-ui\/","url_meta":{"origin":1436,"position":1},"title":"Most Mobile App Complexity Is Not in the UI","author":"","date":"April 6, 2026","format":false,"excerpt":"The hard part of a mobile app is usually not the screen layout. It is sync, auth, state, permissions, offline behavior, and the release problems that show up after the UI already looks finished.","rel":"","context":"In "Programming"","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1187,"url":"https:\/\/wade.one\/blog\/2026\/04\/19\/what-good-error-messages-actually-do\/","url_meta":{"origin":1436,"position":2},"title":"What Good Error Messages Actually Do","author":"","date":"April 19, 2026","format":false,"excerpt":"Good error messages do more than complain. They tell you what happened, what to try next, and what the system needs from you so failure is easier to recover from.","rel":"","context":"In "Programming"","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1344,"url":"https:\/\/wade.one\/blog\/2026\/06\/11\/android-developer-verification-belongs-on-the-release-checklist\/","url_meta":{"origin":1436,"position":3},"title":"Android Developer Verification Belongs on the Release Checklist","author":"Wade","date":"June 11, 2026","format":false,"excerpt":"Android developer verification should be treated like release infrastructure, especially for teams distributing outside Google Play.","rel":"","context":"In "Software"","block_context":{"text":"Software","link":"https:\/\/wade.one\/blog\/category\/software\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1172,"url":"https:\/\/wade.one\/blog\/2026\/04\/05\/what-makes-an-api-feel-nice-to-work-with\/","url_meta":{"origin":1436,"position":4},"title":"What Makes an API Feel Nice to Work With","author":"Wade","date":"April 5, 2026","format":false,"excerpt":"A good API is not just functional. It is predictable, consistent, and easy to use without a lot of guesswork.","rel":"","context":"In "Programming"","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1394,"url":"https:\/\/wade.one\/blog\/2026\/08\/15\/mcp-going-stateless-is-the-boring-fix-it-needed\/","url_meta":{"origin":1436,"position":5},"title":"MCP Going Stateless Is the Boring Fix It Needed","author":"","date":"August 15, 2026","format":false,"excerpt":"MCP's stateless core removes deployment plumbing that should never have been the interesting part of an agent tool.","rel":"","context":"In "Programming"","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/comments?post=1436"}],"version-history":[{"count":1,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1436\/revisions"}],"predecessor-version":[{"id":1458,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1436\/revisions\/1458"}],"wp:attachment":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/media?parent=1436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/categories?post=1436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/tags?post=1436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}