A synchronised passkey is a passkey that is copied and kept in step across multiple user devices so the same credential can be used from more than one endpoint. Technically, it uses passkey-based cryptographic authentication, with private keys protected in device-bound secure storage and synchronisation handled through trusted account services.
How synchronised passkeys work
A synchronised passkey is still a passkey first: it uses public-key cryptography rather than a shared password, and the private key stays protected in secure storage on each device. The difference is that the credential is kept consistent across multiple endpoints through a trusted account service, so a user can sign in from more than one device without re-enrolling each one separately.
That synchronisation changes the operational model more than the cryptographic one. The relying party still sees a phishing-resistant authenticator, but the user experience depends on the device ecosystem, the account service, and the recovery path that ties the devices together.
Why synchronised passkeys matter
Synchronised passkeys solve a real usability problem for passwordless authentication. People now expect to move between phones, laptops, tablets and browsers without losing access, and synchronisation makes that possible while preserving the core benefits of passkeys, including resistance to phishing and credential replay.
They also reduce one of the most common adoption failures in passwordless programmes, namely that a single-device credential becomes unusable when the user changes hardware, loses a phone, or needs to recover access quickly. For organisations, that makes rollout easier and helps the control survive normal device turnover.
At the same time, synchronised passkeys shift some trust from a single endpoint to the account and sync layer. That does not negate the security value, but it means the surrounding account recovery and device trust model matters as much as the authenticator itself.
Security properties and trust boundaries
The main security property is that the private key is not meant to be exposed as a reusable shared secret. Instead, the key material is protected by device-bound secure storage and used through the local authenticator, while the synchronisation service keeps the user’s passkey set aligned across authorised devices.
This creates a layered trust boundary. The passkey remains strong against remote phishing, but the account service, device enrollment process, and recovery workflow become part of the security story. If those surrounding controls are weak, an attacker may target the account lifecycle rather than the cryptographic exchange itself.
In practice, synchronised passkeys should be understood as part of a broader authentication architecture, not as a standalone feature. Their safety depends on how the platform verifies device access, how it handles recovery, and how it protects the account that mediates synchronisation.
Common deployment and governance questions
Organisations usually need to decide whether synchronised passkeys fit their risk model for workforce or consumer authentication, and how much assurance they require from the underlying platform. The important question is not whether passkeys are “good,” but whether the chosen sync ecosystem, recovery path and endpoint trust assumptions match the sensitivity of the account.
Another practical issue is user support. Synchronised passkeys can simplify help desk load by reducing password resets, but they can also create confusion if users do not understand device changes, cross-device sign-in, or what happens after account recovery. Clear policy and user education matter because the credential can exist on more than one endpoint at once.
For organisations, the safest deployment pattern is the one that treats synchronised passkeys as a modern authenticator with real governance requirements, not as a magic replacement for identity verification, recovery controls or session protection.
Risk and Threat Considerations
Synchronised passkeys reduce phishing exposure, but they can concentrate risk in the account or sync service that keeps the credential in step across devices. If that surrounding account is compromised, the attacker may gain access through a trusted recovery or device linkage path instead of stealing the private key directly.
Failure mechanism: An attacker targets the user’s account recovery flow, device trust chain or cloud account access, then uses that path to add a new device, restore access or synchronise the passkey to an endpoint they control.
Impact: The result can be account takeover that bypasses the original phishing-resistant design goal, along with session theft, unauthorised access and a harder forensic problem because the authentication event may look legitimate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Synchronised passkeys rely on protected authenticator lifecycle and recovery handling. |
| IA-2 — Identification and Authentication (Organizational Users) | Workforce passkey sign-in is a core organisational user authentication control. | |
| IA-9 — Service Identification and Authentication | Passkey-backed authentication uses cryptographic authenticator trust between systems and services. | |
| Recommendation — Manage passkey issuance, protection, rotation, and recovery under IA-5. Use IA-2 to require phishing-resistant authentication for workforce access. Apply IA-9 where passkey-based authentication is mediated by services or federated access. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The term sits directly in phishing-resistant authenticator guidance and authenticator assurance. |
| Recommendation — Align passkey deployment with the phishing-resistant guidance and assurance model in SP 800-63. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Synchronised passkeys affect account access paths, recovery, and governance over who can sign in. |
| Recommendation — Tighten access governance and recovery controls for accounts protected by synchronised passkeys. | ||
Practitioner Guidance
Why practitioners should care: Synchronised passkeys are only as strong as the recovery and device trust model around them. If those controls are weak, the organisation may end up replacing password risk with account-service risk rather than removing the problem.
Common misunderstanding: Teams sometimes assume that “passkey” automatically means “safe by default.” In reality, synchronised passkeys still require clear ownership of recovery, device enrolment and support workflows, especially for higher-value accounts.
Practitioner takeaway: Treat the passkey as one control in an authentication chain, and review the account and device governance around it with the same seriousness as the credential itself.