Windows 11 passkeys can be stored either on the PC through Windows Hello or in a synced passkey manager, such as Microsoft Password Manager or a compatible third-party provider. The sign-in prompt may use the same face, fingerprint or Windows Hello PIN in either case, so identify the provider before deleting a passkey, resetting Windows or replacing a computer.
Windows 11 supports plug-in passkey managers on version 24H2 and later. Native support for Microsoft Password Manager and selected third-party providers became generally available with the Windows security update released in November 2025. If the options described below are unavailable, install Windows and browser updates. An organization can also restrict passkey services on a work or school PC.
How to identify where an existing passkey is stored
A Windows Hello prompt does not by itself prove that a passkey is stored locally. Windows Hello protects passkeys saved to the PC, and it can also verify that you approve use of a passkey held by an integrated passkey manager.
Use these checks to find the provider:
- Check the website account page. Open the website’s security, sign-in or passkey settings. Some services show the device or provider associated with each passkey. Microsoft account and work or school account security pages can show where a registered Microsoft passkey was saved.
- Check Windows Settings. Go to Settings > Accounts > Passkeys. Passkeys that can be viewed and deleted there are device-bound passkeys saved locally on that Windows device.
- Check Microsoft Password Manager. In Microsoft Edge, open Settings and more > Settings > Passwords and autofill > Microsoft Password Manager. Passkeys listed there are stored in Microsoft Password Manager rather than only in the local Windows Hello store.
- Check other passkey managers. Open the provider’s application, browser extension or website and search its passkey list for the site or account. Synced passkeys are normally managed through the provider that stores them.
If a passkey appears in a website’s account settings but not in Windows or a passkey manager, it may be on a phone, tablet or FIDO2 security key. The name assigned by the website may help, but websites do not use a consistent naming system.
Choose between local and synced passkeys
A device-bound passkey is saved to one PC through Windows Hello. It does not sync automatically to another computer. You unlock it with a Windows Hello PIN, fingerprint or facial recognition, while the private credential stays associated with that device.
Local storage can suit a tightly controlled PC that you do not share and rarely replace. Its main drawback is recovery: a reset, loss, theft or replacement of the PC can make that passkey unavailable. Keep another sign-in method, another passkey or a documented account-recovery route before depending on a local passkey.
A synced passkey is held by a passkey manager and made available on other supported devices signed in to the same provider account. Microsoft Password Manager, for example, can sync passkeys across supported Windows, iOS and Android devices. On a new device, it may ask you to verify with your Microsoft Password Manager PIN before the synced passkeys can be used.
Third-party passkey managers differ in their device support, recovery procedures, subscription terms and ability to work as a Windows passkey service. Choose one only after confirming that it supports the Windows computers, browsers and mobile devices you actually use.
| Your devices | Usually the best fit | Main precaution |
|---|---|---|
| One Windows PC | Local Windows Hello storage is simple for a controlled computer. A synced manager is more convenient if the PC fails or is replaced. | Keep another recovery method or authenticator before relying on a local passkey. |
| Several Windows PCs | A synced passkey manager avoids registering separate passkeys on every computer. | Secure the manager account and retain any recovery information needed to regain access. |
| Windows, Android and iPhone or iPad | Use a manager that explicitly supports every platform you use. Microsoft Password Manager supports passkeys on Windows, iOS and Android. | Confirm support on every device before removing an older passkey or provider. |
| Windows and Mac | Choose a provider with confirmed Windows and macOS support, rather than assuming that Windows plug-in support also applies on a Mac. | Test sign-in on both platforms before making the passkey your only account recovery option. |
If you are moving from an Android password manager, follow a provider-supported process rather than deleting the old copy first. See how to transfer passkeys between password managers on Android safely.
Manage passkey services in Windows 11
Windows provides a central setting for available passkey services in supported browsers and compatible apps:
- Open Settings.
- Select Accounts.
- Select Passkeys.
- Open Advanced options.
- Turn available passkey services on or off.
To allow local, device-bound storage, turn on Save passkeys to this Windows device. A compatible manager must be installed and configured before it can appear in Advanced options. Windows may require Windows Hello verification when you enable a service.
You can enable more than one service. When a website asks where to save a new passkey, select Change, Save another way or a similar option if the suggested destination is not the one you want. Depending on the site and devices available, the choices can include a password manager, the Windows device, a phone or tablet, or a security key.
Turning a provider off in Advanced options is an availability setting, not a deletion method. It can stop that provider from being offered through the Windows interface, but passkeys in its synced vault must still be managed through that provider. Similarly, turning off local saving does not remove passkeys already stored on the PC.
Microsoft Password Manager is available in Microsoft Edge version 142 or later, and availability can vary by account type, device, browser version and organization policy. If no provider controls appear, update Windows, Edge and the relevant passkey-manager app, then check whether the PC is managed by an employer or school.
Delete passkeys without losing account access
To delete a passkey stored locally on the PC, go to Settings > Accounts > Passkeys, find the entry and select Delete passkey. Windows may ask you to verify the action.
Before deleting any passkey, test at least one other way to enter the account. This could be a synced passkey on another device, a second device-bound passkey, a hardware security key, a password with another verification method, or the website’s documented recovery process.
Deleting a passkey from Windows removes the private credential from that PC. It may not remove the related passkey registration from the website, because the website keeps the public-key record while Windows or the passkey manager keeps the private credential.
For a complete cleanup, review both locations:
- Delete the local passkey from Settings > Accounts > Passkeys, or delete a synced passkey through its manager.
- Open the website’s account-security page and remove the old passkey registration if it remains listed.
For a work or school Microsoft account, Microsoft advises removing the passkey both from the Security info page and from the place where it was saved. Other websites may use different labels and may not show the provider name.
When replacing or resetting a PC, set up and test the new sign-in method first. Synced passkeys should be available after you sign in to the same passkey-manager account on the new device. Local Windows Hello passkeys do not transfer, so create and test a replacement passkey before erasing the old computer or removing its registration from the website.
