Device-bound vs synced passkeys: which to require
Passkeys come in two flavours — hardware-bound keys that never leave one device, and synced passkeys backed up to a cloud keychain. They trade assurance for convenience differently. How to choose per use case.
All passkeys are FIDO credentials and all are phishing-resistant. Where they differ is what happens to the private key. That distinction — device-bound versus synced — is the main policy decision when you roll passkeys out.
Device-bound (hardware-bound) passkeys
The private key is generated in, and never leaves, a single authenticator — typically a hardware security key (FIDO2 key) or a platform secure element. It cannot be copied or synced. This is the highest-assurance option: possession of that exact device is genuinely required. The trade-off is recovery — lose the device and the credential is gone, so you must enrol a backup authenticator. This is the right default for administrators, privileged access, and high-security environments.
Synced passkeys
The private key is stored in a credential manager (Apple iCloud Keychain, Google Password Manager, or a third-party manager) and end-to-end encrypted, then synced across the user's devices. If they get a new phone, their passkeys come with them. This is dramatically better than passwords and is what makes passkeys viable for a general workforce or consumer base. The trade-off is that the assurance now rests partly on the security of the cloud account and its recovery, and the key is no longer bound to one piece of hardware.
Match the passkey type to the risk
Require device-bound (hardware) passkeys for admins, privileged roles, and regulated high-assurance systems where you must prove single-device possession. Allow synced passkeys for the broad workforce and customers, where the reduction in phishing and password reuse is the big win and convenience drives adoption.
WebAuthn gives the relying party signals — including attestation and a backup-eligibility flag — to tell whether a credential is device-bound or syncable, so you can enforce this policy at registration rather than trusting users to pick correctly. For the strictest environments (matching NSA/PIV-style requirements), attestation lets you accept only approved hardware authenticators.