Comparison
Synced vs device-bound passkeys
Synced vs device-bound passkeys: what’s the difference?
Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.
Synced vs device-bound passkeys: what’s the difference? Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases. Source: https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/ (Cleartext, verified 2026-09-24)
A
Synced passkeys
Backed up and copied across the user’s devices by Apple, Google or a password manager.
B
Device-bound passkeys
Never leave the hardware they were created on, such as a security key.
Comparison table #
7 criteria · stronger: Synced passkeys 2, Device-bound passkeys 1 · even or not comparable: 4
| Criterion | Synced passkeys | Device-bound passkeys |
|---|---|---|
| Where the private key lives | In the sync provider’s end-to-end encrypted store, copied to the user’s devices | Only on the device or security key where it was created |
| Phishing-resistant | Yes | Yes |
| Lost device | Restored from the sync accountStronger | Lost, unless another credential is registered |
| New risk introduced | Takeover of the sync account | Physical loss or theft of the device |
| NIST SP 800-63B-4 | Accepted at AAL2 | Hardware-bound keys eligible for AAL3Stronger |
| Typical users | Consumers and most banking logins | Administrators, privileged staff and high-risk users |
| Cost | Included with the platformStronger | Hardware keys must be bought and issued |
Verdict #
Use synced passkeys for customers: they deliver phishing resistance without the lost-device problem. Use device-bound keys for anyone whose account could do outsized damage, and for any use case that must reach AAL3.
Choose Synced passkeys when
Consumer and retail banking sign-in, where recovery from a lost phone must be easy.
Choose Device-bound passkeys when
Administrators, production access, treasury approvals and AAL3 requirements.
Evidence #
Related questions #
Are synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerWhat is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.
Full answerCite this comparison #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Synced vs device-bound passkeys” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/
Markdown link
[Synced vs device-bound passkeys](https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |