Passkeys - and where to stall them?

I've recently been setting up a few Passkeys and they have been installed somewhere on my system. The last one I generated also offered to save it to another external location.

• Is it possible to access this 'system' location?
• Can I move these to an 'external' location?
• Will I have to delete the 'system held' keys - if so, how? - in order to set them up on an 'external' location?
• What happens to them if I do a clean install of Windows?

See Settings, Accounts, Passkeys including the link to Learn more about passkeys in Windows.

IanMosley said:

I've recently been setting up a few Passkeys and they have been installed somewhere on my system. The last one I generated also offered to save it to another external location.

• Can I move these to an 'external' location?
• Will I have to delete the 'system held' keys - if so, how? - in order to set them up on an 'external' location?
  What happens to them if I do a clean install of Windows?

Click to expand...

No, you delete the entry in your online account, and then use the interface mentioned by @BruceR to remove it from Windows/Windows Hello. Note that it's a similar situation with your security key (if you use it), but you need to use the software provided by the key manufacturer to delete the entry from the key.

I don't know for sure what happens in a clean reinstall, because it seems that some or all of the TPM's info may survive. However, I wouldn't bet that all the passkey information (website, email, private key, metadata) can be stored in the TPM, and I suspect that some are stored on disk. I would treat a clean installation as if I would lose all the passkeys/WebAuthn 2FA.