Synced Passkey

A synced passkey is a passkey that a passkey provider, such as a platform keychain or password manager, copies across the user's devices through a cloud service; a device-bound passkey never leaves the single device or security key that created it. These are the FIDO Alliance's terms for the two when the distinction matters.

Both kinds are phishing-resistant, because both are bound to the site's origin. The difference is custody: a synced passkey survives a lost phone and follows the user to a new device, which is what drives consumer adoption (the FIDO Passkey Index 2026 found passkeys in 36% of sign-ins at participating services), but its security also depends on the sync account and every endpoint the key lands on, as Unit 42's research extracting Google synced passkey keys showed. FIDO says device-bound passkeys on hardware security keys offer the highest assurance and meet the most stringent compliance requirements, so the usual split is synced passkeys for customers and most staff, and device-bound passkeys for administrators and regulated access, in line with NIST SP 800-63B-4, which accepts syncable authenticators at AAL2 but requires non-exportable keys at AAL3.

See also: passkey, phishing-resistant MFA, AAL, implementing passkeys in the enterprise