Synced vs. Device-bound Passkeys: What is the difference?

This distinction is particularly important for companies: "Device-bound" alone does not indicate how a passkey is used in everyday life. It is also crucial to know what type of authenticator it is based on.

Are synced passkeys insecure?

The current research findings do not mean that synced passkeys are fundamentally insecure. Rather, they show that with synchronized passkeys, in addition to the actual FIDO authentication, the mechanisms for synchronization, device onboarding, and recovery must also be included in the security considerations.

Synced passkeys offer significant security advantages over traditional passwords and particularly protect against many phishing attacks and credential stuffing.

However, with synced passkeys, not only the actual login must be considered. The synchronization between devices, adding new devices, and recovering access are also part of the security concept.

A practical example:

A company protects an application with a phishing-resistant passkey. The passkey itself is cryptographically well protected. However, if a user can add a new device or recover their account through a significantly weaker protected recovery process, this process also becomes part of the security model.

An attacker does not necessarily have to target the strongest protection mechanism. They will try to find the easiest available way to the account.

Therefore, the question “Is the passkey secure?” is not sufficient for companies.

At least as important is:

How does a new device or a new authenticator get to the account?

Are device-bound passkeys more secure?

Device-bound passkeys have a specific security property compared to synced passkeys: The credential remains bound to the respective authenticator and is not synchronized to other authenticators via a synchronization infrastructure.

However, this does not mean that a computer with a hardware security key cannot be compromised.

For example, if an administrator's laptop is infected with malware, an attacker can still attempt to attack sessions or data on that computer. The security key does not make the compromised computer secure again.

The difference lies elsewhere: The credential itself remains on the hardware authenticator. The security key can be used on different computers, but the credential is not transferred to these computers or to other authenticators.

For a privileged administrator, this property may be desired.

For a regular employee, however, the ease of use across multiple devices and a straightforward device switch may weigh more heavily.

Whether device-bound is "safer" can only be answered if it is clear what risk a company wants to protect against.

Example 1: Employee with laptop and smartphone

An employee primarily works with cloud applications. He uses a company laptop and a smartphone and regularly changes his devices.

Here, a synced passkey can offer advantages: The employee does not have to re-register all passkeys with each device change.

The company must clarify which passkey ecosystem may be used, which devices can be integrated, and how access recovery is secured.

A hardware security key can also be used here.An advantage of an external security key is that the same authenticator can be used on different compatible devices.If a second key is to be available as a backup, it must be registered separately.

The additional effort for issuance, replacement, and registration should correspond to a specific security need.

Example 2: Administrator with privileged access

An administrator can change user accounts, configure systems, or access particularly sensitive company resources.

Here, the company can consciously decide that the credential should not be synchronized through a cloud ecosystem.

Instead, the administrator receives a shared hardware security key. A second registered key can be securely stored as a backup.

If a key is lost, it is locked, and the administrator uses the previously registered replacement key or goes through a defined process for a new authenticator.

The advantage is concrete: The company can better control which approved authenticators the credentials for this privileged access may reside on.

Example 3: Many employees and a large rollout

With 50 users, issuing an additional authenticator is something different than with 5,000 or 50,000 users.

If hardware security keys are to be used, very practical questions arise:

• Who orders the keys?
• Are they pre-configured before issuance?
• How do they get to the employee?
• How are external employees or international locations supplied?
• Is a second key issued as a backup?
• What happens in case of loss?
• How does an employee quickly receive a replacement?
• Who assists with registration?

With synced passkeys, some of these questions shift. For this, the configuration of the platform, allowed devices, synchronization, and recovery become more important.

The decision is therefore not only a technical security decision but also a question, how authentication should work in daily operations.

Companies do not have to give all employees the same type of passkey.

A frequently overlooked option is to secure different user groups differently.

For example, a company might decide:

Standard workstations: Synced passkeys are allowed as long as the company policies and the deployed ecosystem meet the requirements.

Administrators and privileged users: Device-bound credentials on shared hardware security keys.

Special workstations or applications: A custom solution according to the technical and organizational requirements.

This is just one example – not a universal recommendation.

The crucial point is: The passkey strategy does not have to look the same for 5,000 employees just because they all work at the same company.

What should a company clarify specifically before making a decision?

Instead of weighing abstractly between "more security" and "more convenience," specific questions help:

1. Which users are we protecting?

An office employee and an administrator with extensive permissions do not necessarily have the same protection needs.

2. What systems can these users access?

Access to general internal applications has different potential impacts than privileged access to critical systems.

3. What devices are the users using?

Company laptop, smartphone, personal device, shared workstation, or multiple devices?

4. Which authenticators should be used?

Should an integrated authenticator in the device be used, or for example, an external hardware security key that can be used on various compatible devices?

5. What happens during device change?

Can the passkey become available on the new device through an approved ecosystem? Can an existing external security key be easily reused? Or does a new credential need to be registered for the authenticator of the new device?

6. What happens in case of loss?

Is a device or the authenticator itself lost? Is there another connected device, a second security key, or a secure way to register a replacement?

7. What fallback procedures remain allowed?

If a highly secured account can simply fall back to SMS or another weaker method in case of problems, this path must also be included in the risk assessment.

8. How many users need to be equipped?

In a large rollout, provisioning, pre-configuration, shipping, replacement, and support play a significantly larger role than in a small administrator group.

The passkey alone does not determine security

The discussion about synced and device-bound passkeys should not obscure another important point: Strong authentication is only as strong as the processes and alternatives that surround it.

When a company introduces phishing-resistant passkeys, but at the same time allows sign-in or account recovery through significantly weaker methods, attackers may try to circumvent these paths.

Therefore, companies should also examine, in addition to the passkey itself:

• How are new authenticators registered?
• How is a user's identity verified during a recovery?
• What fallback methods are still allowed?
• How is a lost authenticator locked?
• What devices and authenticators are allowed?
• How are particularly privileged accounts treated?

The choice between synced and device-bound is thus a component of a passkey strategy – but not the entire strategy.

Conclusion: Not synced or device-bound for everyone – but suitable for the use case

Synced and device-bound passkeys address different practical requirements.

Synced passkeys can significantly simplify use across multiple devices and device changes. For this, the ecosystem used, adding new devices, and recovering access become part of the security consideration.

Device-bound passkeys forgo the synchronization of credentials to other authenticators. However, how this plays out in practice also depends on what type of authenticator the passkey is on..

With an integrated authenticator, a new registration may be required for a new device. An external hardware security key, on the other hand, can be used on various compatible devices while the credential remains on the key.

With hardware security keys, a company can consciously bind privileged access to shared physical authenticators. If additional or backup keys are to be used, they must be registered separately and provided accordingly.

For companies, the crucial question is therefore not:

"Which type of passkey is fundamentally better?"

But:

"For which users and applications do we need what level of control, security, and user-friendliness – and how does the solution work in practice?"