Unknown passkey
An unknown passkey on your Google account: check before you remove.
An unknown passkey is not necessarily an intrusion: Google states that an Android device signed in to your account may register passkeys automatically, and a password manager can create them too. First check where it comes from and make sure your recovery phone and email work. If it isn’t yours, remove it, sign out the device concerned and secure the account — without deleting your last way in.
Reviewed on by Danilson Ramos · version 1.0
In order, from a trusted device
- Don’t delete anything in a rushStay signed in on the trusted device that still has access to the account.
- Check your recovery methodsRecovery phone and email must be yours and working. They are your safety net if a step goes wrong.
- Compare with your devicesOld phone, work computer, tablet, password manager: a passkey can come from any of them. Signed-in Android devices can register some automatically.
- Review the device listUnder “Manage all devices”: sign out an unknown device there. Google states this is also how to remove a passkey registered automatically by an Android device.
- Remove the passkey if it isn’t yoursGoogle Account → Security & sign-in → Passkeys and security keys → select the passkey → Remove. If it is also in a third-party password manager, remove it there too.
- Secure the rest of the accountIf the passkey wasn’t yours: change the password, review recent sign-ins, Gmail filters and forwarding, and authorised apps.
What not to do
- Don’t remove your last working sign-in or recovery method, and don’t sign out of your only trusted device.
- Don’t change security settings from a device or network you don’t control.
- Don’t send anyone a screenshot showing a code, and never share a verification code.
- Don’t jump to conclusions: an unknown passkey can come from one of your own devices.
What should make you check
- A passkey you don’t recognise under “Passkeys and security keys”.
- An unknown device in the list of devices with account access.
- A security alert you didn’t expect.
- Other signs at the same time: unknown sign-in, changed setting, unknown email forward.
The legitimate options
Google’s passkey management
Listing and removing passkeys happens in your Google Account sign-in options.
The device list
It shows devices signed in now or in the last few weeks and lets you sign them out.
Google’s “hacked account” procedure
If other signs add up, follow the full account securing steps.
When a specialist helps
- You are sure the passkey isn’t yours and other signs appear.
- Google asks for a verification you cannot complete before changing security.
- Your only remaining way in is fragile (a single device, no reliable recovery).
- The account is used for bank, payment or business accounts.
Cyber Initial Diagnosis
An independent view before you touch account security
CHF 99
The diagnosis reviews your screenshots (passkeys, devices, alerts) and gives you a written order of actions designed not to cut off your own access. I never sign in to your account.
- A review of one main incident or one compromised account, based on the facts and evidence you provide
- The legitimate recovery and access options open to you
- The immediate risks, ranked by urgency
- A written action plan: what to do, in which order, through which official channel
- A clear answer on whether a follow-up intervention is useful and feasible
Limits
- Only Google decides which checks it requires and any recovery.
- A screenshot does not always prove where a passkey comes from: the uncertainty is stated clearly.
- Bynilson is independent of Google.
- No recovery or remediation work is included (quoted separately when useful)
- No guaranteed outcome: only the provider (Google, Microsoft…) decides to restore access
- No monitoring and no emergency on-call
- One incident or one account per diagnosis
Frequently asked questions
What is a passkey?
A way to sign in without a password, using your device’s screen lock (fingerprint, face, PIN). An unknown passkey on your account therefore deserves a check.
Why does a passkey appear that I didn’t create?
Google states that an Android device signed in to your account may register passkeys automatically. A password manager can create them too. It is not necessarily an intrusion.
Is removing the passkey enough?
If it isn’t yours, no: remove it, sign out the device concerned, change the password and check the rest of the account, in that order.
What if Google asks for a verification I cannot complete?
Don’t force anything and don’t bypass anything. Keep your trusted device signed in, check your recovery methods and get advice before going further.