Writing Your Own Passkey Recovery Plan Before You Need It

Most people set up a passkey or an authenticator app in a few minutes and never write down what happens next. That is fine until a phone is lost, a screen cracks, or an app is reinstalled on a new device and the codes stop matching. At that point the account holder is guessing under pressure, often while a market move is happening and every minute feels expensive. A recovery plan is simply a short document you write in advance that says which device holds which credential, what backup exists, which official page explains the reset path for each exchange you use, and what you will do first if something breaks. This guide walks through drafting that document for a multi-exchange setup common among Filipino users, without pretending any single method is foolproof. You will decide what to record, how to store it, how to test it, and when to stop and contact official support instead of improvising. Nothing here replaces the help centre of the platform you actually use, and nothing here is investment advice.

Start by listing every credential you actually depend on

Before writing a plan, take inventory. Open each exchange you use and go to the account settings or security section, then note which second factor is active: a passkey tied to a device, an authenticator app entry, SMS, email confirmation, or a combination. Do not write the secret seeds or codes themselves into this list. Record only the type of factor, the label you gave it, and the device or app it lives on. If you use Binance, OKX, Bybit and Bitget, you will likely find four separate authenticator entries and possibly several passkeys, and that is exactly the fragmentation a plan is meant to make visible.

The second part of the inventory is the recovery surface underneath each factor. Check the help centre for each platform and note whether recovery runs through a verified email, a support ticket, a re-verification of identity documents, or a waiting period. You are not memorising the flow, you are writing down where the authoritative description lives so you can find it fast later. Treat every interface detail as something to confirm on the day, because menus and wording change and your notes may be months old.

Finally, mark which accounts hold meaningful balances and which are dormant. A plan does not need equal detail for an account you opened once and never funded. Sorting by consequence tells you where to spend your testing time and where a simple note is enough.

Decide what goes in the document and what never does

A useful plan contains four kinds of information: the inventory from the previous step, the recovery path for each account, the order in which you would act, and the evidence you would need to prove ownership. Evidence usually means the email address on the account, the phone number registered, the identity documents used during verification, and any account identifiers shown in your profile. Write those down as pointers, not as copies of sensitive files.

What never goes in the document is equally important. Do not store authenticator seeds, passkey private material, passwords, one-time codes, or full images of identity documents in the same place as the plan. If the plan is a note on your phone and the phone is the device you lost, a plan that contains secrets is worse than no plan at all. Keep secrets in your password manager or wherever you already keep them, and keep the plan as a map that points to those places.

Write the plan so another trusted person could follow it with you present. That constraint forces plain language and short sentences, and it exposes gaps such as an email account only you can open because the recovery phone for that email is the phone that broke. Many real lockouts are email lockouts in disguise, so treat your email and SIM arrangements as part of the same document.

Store it in two places and rehearse the first ten minutes

Choose two storage locations that fail independently. A common pattern is a printed copy kept with other important household documents and an encrypted digital copy in a password manager that syncs to a device you did not lose. Avoid storing the only copy on the device that holds the passkeys, and avoid a storage method you cannot open without the very credential you are trying to recover.

Then rehearse. Pick one account with a low balance and walk through the beginning of the recovery path without completing anything destructive. Confirm that you can open the email address listed on the account, that you still control the registered phone number, and that your identity documents are current and readable. Note how long each step took and where you hesitated. Hesitation points are the parts of the plan that need rewriting.

Agree on a stop condition before you start. If a recovery flow asks you to disable a factor, move funds, or approve something you did not expect, stop and verify through the official help centre first. Recovery is a favourite target for impersonation, so anyone who contacts you offering to speed it up is a signal to slow down, not to cooperate.

Keep it current and know when to hand it to support

A plan decays quietly. Every time you add a device, change a phone number, replace a SIM, reinstall an authenticator, or add a passkey, update the inventory and the date at the top of the document. A monthly glance is enough for most people, and a full walkthrough once or twice a year keeps the steps honest. If you trade actively, align the review with any change to your device lineup rather than with a calendar date.

When a recovery path genuinely requires the platform, go through the official help centre and open a ticket from the account or the email address associated with it. Have your evidence pointers ready, describe the situation factually, and keep every reply in one thread. Do not send identity documents to anyone who messages you first, and do not accept help offered through social media or chat groups.

Record what happened afterwards: which step failed, what support asked for, how long it took, and what you changed as a result. That short entry turns a stressful event into the most valuable page in the document, and it is the page you will read first the next time something breaks.

Risk boundary: Philippines Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• List every exchange account you hold and, for each one, the exact second factor in use and the device or app it lives on, without writing down any secret seed or code.
• For each account, note in one line where the official help centre describes the recovery path, and confirm that page is reachable from a device that is not the one holding your passkeys.
• Verify you can still open the email address and phone number registered on each account, since email and SIM problems are the most common hidden cause of a lockout.
• Store one printed copy and one encrypted digital copy in locations that do not depend on the lost device, and never store secrets in the same place as the plan.
• Rehearse the first steps on a low-balance account, write down where you hesitated, and set a stop condition for anything that asks you to disable a factor or move funds.
• Update the plan and its date whenever you add a device, change a phone number, reinstall an authenticator, or add a new passkey.