What is the difference between device-bound and synced passkeys?

How device-bound and synced passkeys differ in practice

Device-bound passkeys are anchored to a single device, so possession of that device is part of the trust model. Synced passkeys trade some of that hardware locality for usability: they can follow the user across devices through an account and sync service. That makes the credential easier to recover, but it also introduces more parties and recovery paths to govern.

The practical difference is not just portability. A device-bound passkey usually gives the relying party a tighter control boundary, while a synced passkey shifts some trust into the platform or password manager that stores and syncs it. For teams comparing sign-in methods, this is where Passkeys for Everyone Guide is useful because it explains the user experience and storage model in plain terms.

What changes for assurance, recovery, and enterprise governance

The main security question is what happens when the original device is lost, replaced, or compromised. Device-bound passkeys can be harder to clone or export, but they usually require a deliberate recovery path if the device is gone. Synced passkeys reduce friction for users, yet the enterprise must account for account recovery, sync provider trust, and the possibility that compromise of the sync ecosystem broadens exposure.

That is why a passkey policy should be written around assurance and recovery, not just login convenience. NIST SP 800-63 Digital Identity Guidelines is the primary external reference for how authenticator assurance and phishing-resistant sign-in are treated, while NIST SP 800-63B-4 Authenticator Assurance Levels Guide shows how synced authenticators, recovery, and session expectations fit together.

Enterprises also need to distinguish user convenience from governance simplicity. A synced passkey may be acceptable for lower-risk populations, but for higher-sensitivity access you may prefer tighter device posture, stronger recovery controls, or a policy that limits which authenticators are allowed. The right answer depends on whether the recovery channel is as trustworthy as the primary authenticator.

When one model is safer than the other

Device-bound passkeys are usually the better fit when you want the authenticator itself to carry more of the security burden and you can tolerate stricter device dependence. Synced passkeys are usually better when users need continuity across phones, laptops, and browser ecosystems, especially where lost-device recovery would otherwise become a major support burden. The key is to decide whether portability or containment is the higher priority.

If your model depends on low support overhead, synced passkeys can reduce user friction, but they can also make recovery design more important than the passkey format itself. If your model depends on tighter device control, a device-bound approach better preserves the original device as a security anchor. Passkey Rollout Guide is the most relevant internal reference for deciding which passkey type to use by population and rollout stage.

For teams that need a clearer policy baseline, Hardware Security Keys Buyer's Guide is a useful comparator because it highlights the more device-anchored end of the spectrum, while FIDO Credential Exchange Passkey Portability Guide explains how portability and export policy work when passkeys move between credential managers.

Risk and Threat Considerations

Synced passkeys widen the trust boundary beyond the original device, so the practical risk is not merely theft of a phone or laptop. The more important exposure is compromise of the account recovery path, the sync service, or a device that can re-materialise the credential elsewhere. Device-bound passkeys narrow that blast radius, but they can still be undermined if the surrounding recovery or session layer is weak.

Failure mechanism: An attacker targets the weakest part of the broader trust chain, often recovery workflows, cloud sync access, or an already signed-in session, rather than trying to break the passkey cryptography itself.

Impact: The credential can be reintroduced onto another device or used to regain access despite the original device being lost, stolen, or locked down, which makes recovery governance a first-class control issue.

Practitioner Guidance

What to verify: Decide whether your policy is optimising for device containment or for user continuity. If you allow synced passkeys, verify which recovery paths exist, who can approve them, and whether those paths are stronger than the password flows you are trying to replace.

Decision rule: If the account can access sensitive systems, treat sync and recovery infrastructure as part of the authenticator trust boundary. If that boundary is too broad for the role, prefer a more device-anchored model or require compensating controls such as stricter device posture and step-up checks.

Practitioner takeaway: The meaningful distinction is not “portable versus not portable”, it is whether your organisation is willing to extend trust from a single device to the surrounding recovery and sync ecosystem.

Related resources from NHI Mgmt Group

• Guide: Passwordless and Passkeys Guide
• What is the difference between synced passkeys and device-bound passkeys?
• Why do synced passkeys reduce friction compared with device bound biometrics alone?
• Should organisations use synced or device-bound passkeys for privileged access?
• How should security teams decide where to use syncable passkeys versus device-bound keys?