# Are synced passkeys phishing-resistant?

> **Short answer:** Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.

- URL: https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/
- Last verified: 2026-09-05 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Why passkeys resist phishing

A passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain.[^3] A phishing page on a look-alike domain never receives a credential it could replay, and there is no code for an attacker to ask the user to read out.[^1]

## What syncing changes

Synced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control.

## How NIST treats them

NIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target.[^1][^2] High-assurance use cases that require AAL3 still call for hardware-bound keys. Compare the two: [synced vs device-bound passkeys](https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/).

## What this means for you

### Banks & credit unions

Synced passkeys meet the assurance level most retail banking logins target, and they are the easiest phishing-resistant option to roll out to customers. Keep device-bound keys for staff with administrative access.

### Fintechs & payment firms

Offer passkeys as the default for returning users. Watch account recovery closely, because that is where passkey deployments get attacked.

### Developers & identity teams

Use the WebAuthn API and let the platform handle syncing. Don’t fall back to SMS codes in recovery, or you reintroduce the weakness passkeys removed.

## Follow-up questions

**What is the difference between a synced and a device-bound passkey?**

A synced passkey is backed up and copied across a user’s devices by a provider such as Apple, Google or a password manager. A device-bound passkey never leaves the hardware it was created on, such as a security key.

**Can a phishing site trick a passkey?**

No. The browser only offers a passkey to the domain it was registered for, so a look-alike domain gets nothing to relay.


## Sources

[^1]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)
[^2]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^3]: Web Authentication: An API for accessing Public Key Credentials. W3C. https://www.w3.org/TR/webauthn/

## Related questions

- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)
- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)

## Cite

Cleartext. “Are synced passkeys phishing-resistant?” Last verified 2026-09-05 (rev. 1). https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/

## Changelog

- 2026-09-05: First published.