Setting Up Passkeys and Authenticators With Safe Device Migration

Changing a phone is one of the most common ways people lose access to a crypto exchange account, because the login method, the authenticator app and the registered phone number often all live on the same device. The fix is not a single setting but a sequence: set up more than one way to sign in, confirm each one works, and only then retire the old handset. This guide walks through that sequence for accounts on Binance, OKX, Bybit and Bitget, with the checks a Pakistani reader should complete before, during and after a device change. It does not cover fees, promotions or trading, and it does not replace the official help centre of whichever platform you use, which is where the exact menu names and current requirements for your account live.

What passkeys and authenticator apps actually do

A passkey is a credential stored on your device, unlocked by your fingerprint, face or device PIN, that replaces a typed password for some or all logins. An authenticator app generates short-lived codes that you enter after your password. They solve different problems: a passkey is convenient and resistant to code theft, while an authenticator app works even when the device that holds the passkey is unavailable. Many exchange accounts end up relying on both, plus SMS or email as a fallback, and that layering is what protects you when one device disappears.

The important consequence is that these methods are tied to hardware and to accounts you control elsewhere. A passkey saved only on one phone, or an authenticator app installed on one phone with no backup, becomes a single point of failure the moment that phone is lost, stolen, reset or replaced. Before you add anything, open the security section of your account settings and write down which methods are currently active, which one is listed as primary, and whether a recovery code or backup method exists. Treat that list as the document you will work from.

Terminology varies. What one platform calls two-factor authentication, another splits into login verification and withdrawal verification, and passkeys may sit under a heading such as security keys or biometric login. Rather than guessing, search the official help centre for the exact feature name you see on screen and read the platform's own description before changing anything. If a term is unclear, that is a signal to stop and read further, not to click through.

Setting up a passkey and an authenticator app in the right order

Start with the authenticator app, because it is the method most platforms use for withdrawals and for changing other security settings. Install a reputable authenticator app on your current phone, then in the exchange's security settings choose to enable app-based verification and scan the QR code shown. The platform will display a secret key or setup code alongside the QR image; copy that key into your password manager or write it on paper and store it somewhere physically separate from the phone. That key is what lets you rebuild the codes on a new device later.

Next, confirm the authenticator works before touching anything else. Log out, log back in, and complete a verification prompt using a fresh code. If the code is rejected, check the phone's clock is set to automatic time, since drifting time is the most common cause of invalid codes. Some readers in Pakistan also find that a code generated offline is accepted only within a short window, so enter it promptly rather than generating several and using an old one.

Only after the authenticator is proven should you add a passkey, and only on a device you physically control. When the platform offers to create one, it will hand the credential to your device's built-in credential manager or password manager. Decide deliberately where it lands: a passkey stored in a cloud-synced manager can be recovered on a new phone, while one stored only in the device's secure hardware cannot. Whichever you choose, record which manager holds it. Finally, review your fallback methods. If SMS or email is your only backup, make sure the phone number and email address on file are current and that you can still receive messages on them.

Preparing for a phone change without losing access

Before you wipe, sell or hand over your old phone, do three things. First, add the authenticator secret to the new phone by installing the same authenticator app there and importing the account using the setup key you saved earlier, or by using the app's own export and transfer feature if it has one. Verify that the new phone generates a code the exchange accepts while the old phone is still available, so you have a working path if something goes wrong. Second, if your passkey lives only on the old device, create a replacement passkey on the new device and test it, then remove the old one from the exchange's security settings. Third, check that your registered phone number and email still work and that you can complete a login verification on the new handset.

Do not remove the old method until the new one is confirmed working. The order matters: add, test, then remove. Readers frequently do the reverse, disabling the authenticator first and only then discovering that the new device cannot complete setup, which can leave the account with no usable second factor. If the platform requires a waiting period before a new security method becomes active, note that period and plan the phone change around it rather than during it.

Keep a written record, stored offline, of which methods are enabled, which device or manager holds each passkey, where the authenticator setup key is kept, and the date you last verified each one. This is not sensitive enough to be dangerous if stored sensibly, but it is exactly the information you will not remember six months from now. If you travel or change SIM cards, re-verify the fallback methods afterwards, because a number that no longer receives messages is a fallback in name only.

When something breaks and what to verify afterwards

If you lose the phone before migrating, your recovery route depends on what you enabled in advance. A cloud-synced passkey or an authenticator app with its own backup may restore access on a new device with no platform involvement. Otherwise you will need the platform's account recovery process, which typically asks for identity documents and may take time. Use the official help centre to find the correct recovery procedure for your account type, and never respond to unsolicited messages offering to restore access, since those are a common impersonation tactic.

Common mistakes are worth naming. Generating codes on a device whose clock is wrong, storing the authenticator setup key only inside the same phone that holds the app, deleting the authenticator entry before the replacement is tested, and assuming that a passkey synced to one ecosystem will appear on a phone from a different one. Another frequent error is relying on a phone number that has been reassigned or a SIM that has expired, which quietly removes your last fallback.

After any device change, log in from the new phone, complete a small verification action, and check the security settings page to confirm exactly which methods are listed and which is primary. Record the date of that check. If the platform shows a session or device list, review it and sign out anything you do not recognise. For anything you cannot resolve yourself, contact support only through the channel listed inside the official app or help centre, and be ready to describe what you enabled and when.

Risk boundary: Pakistan Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• List every active login and verification method in your account security settings, and note which one is primary and which fallback exists.
• Save the authenticator setup key outside the phone, on paper or in a password manager, before relying on the app.
• Test a freshly generated authenticator code by logging out and back in, checking the device clock is set to automatic time.
• Add and test a passkey on the new device before removing the old one, and confirm which manager stores it.
• Verify your registered phone number and email still receive messages before wiping or selling the old handset.
• Record the date of each verification and the recovery route you would use if the phone were lost.