# Synced vs device-bound passkeys

> **Verdict in brief:** Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.

- URL: https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

**A. Synced passkeys:** Backed up and copied across the user’s devices by Apple, Google or a password manager.

**B. Device-bound passkeys:** Never leave the hardware they were created on, such as a security key.

## Comparison table

| Criterion | Synced passkeys | Device-bound passkeys |
|---|---|---|
| Where the private key lives | In the sync provider’s end-to-end encrypted store, copied to the user’s devices | Only on the device or security key where it was created |
| Phishing-resistant | Yes | Yes |
| Lost device | Restored from the sync account (stronger) | Lost, unless another credential is registered |
| New risk introduced | Takeover of the sync account | Physical loss or theft of the device |
| NIST SP 800-63B-4 | Accepted at AAL2 | Hardware-bound keys eligible for AAL3 (stronger) |
| Typical users | Consumers and most banking logins | Administrators, privileged staff and high-risk users |
| Cost | Included with the platform (stronger) | Hardware keys must be bought and issued |

Cleartext comparison, based on NIST SP 800-63B-4[^1], the FIDO Alliance[^2] and W3C WebAuthn[^3].

## Verdict

Use synced passkeys for customers: they deliver phishing resistance without the lost-device problem. Use device-bound keys for anyone whose account could do outsized damage, and for any use case that must reach AAL3.

- **Choose Synced passkeys when:** Consumer and retail banking sign-in, where recovery from a lost phone must be easy.
- **Choose Device-bound passkeys when:** Administrators, production access, treasury approvals and AAL3 requirements.

## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)
[^3]: Web Authentication: An API for accessing Public Key Credentials. W3C. https://www.w3.org/TR/webauthn/

## Related questions

- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)

## Cite

Cleartext. “Synced vs device-bound passkeys” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/

## Changelog

- 2026-09-24: First published.