Question Identity
Are synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Are synced passkeys phishing-resistant? Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own. Source: https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/ (Cleartext, verified 2026-09-05)
Why passkeys resist phishing #
A passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain.[3] A phishing page on a look-alike domain never receives a credential it could replay, and there is no code for an attacker to ask the user to read out.[1]
What syncing changes #
Synced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control.
How NIST treats them #
NIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target.[1][2] High-assurance use cases that require AAL3 still call for hardware-bound keys. Compare the two: synced vs device-bound passkeys.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Synced passkeys meet the assurance level most retail banking logins target, and they are the easiest phishing-resistant option to roll out to customers. Keep device-bound keys for staff with administrative access.
Fintechs & payment firms
Offer passkeys as the default for returning users. Watch account recovery closely, because that is where passkey deployments get attacked.
Developers & identity teams
Use the WebAuthn API and let the platform handle syncing. Don’t fall back to SMS codes in recovery, or you reintroduce the weakness passkeys removed.
Follow-up questions #
- What is the difference between a synced and a device-bound passkey?
- A synced passkey is backed up and copied across a user’s devices by a provider such as Apple, Google or a password manager. A device-bound passkey never leaves the hardware it was created on, such as a security key.
- Can a phishing site trick a passkey?
- No. The browser only offers a passkey to the domain it was registered for, so a look-alike domain gets nothing to relay.
People also ask #
What is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.
Full answerIs SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerHow do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Are synced passkeys phishing-resistant?” Last verified 2026-09-05 (rev. 1). https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/
Markdown link
[Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/) (Cleartext, verified 2026-09-05)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |