What is the difference between synced passkeys and device-bound passkeys?

Why This Matters for Security Teams

Synced and device-bound passkeys solve the same authentication problem, but they create different operational risk profiles. Synced passkeys improve user recovery and continuity, yet they also extend trust into the vendor ecosystem that synchronises them. Device-bound passkeys keep the credential local, which strengthens containment, but they can increase support burden and make device loss more painful. For NHI Management Group, the key issue is not convenience versus inconvenience. It is whether the organisation wants portability, locality, or a deliberate mix of both.

This choice should be evaluated in the context of broader identity and access design, not as an isolated login feature. The NIST Cybersecurity Framework 2.0 emphasises governance, identity assurance, and resilient access patterns, which is why passkey strategy should sit alongside phishing resistance, recovery planning, and device trust rules. The NHI guidance in the Ultimate Guide to NHIs - What are Non-Human Identities is equally relevant because the same design tension appears with secrets, service accounts, and workload credentials. If a credential can move, then recovery gets easier, but containment gets broader. In practice, many security teams discover that tradeoff only after an account recovery event or endpoint loss has already exposed the weakness in their chosen model.

How It Works in Practice

Synced passkeys are typically backed by a cloud or ecosystem account that replicates the private credential across trusted devices. That means the user can sign in from a new phone or laptop without re-registering every service, which lowers friction and reduces lockout cases. Device-bound passkeys, by contrast, keep the private key on the original device or secure hardware element, so the credential does not follow the user elsewhere. That stronger containment can be useful for regulated environments, privileged administrators, or endpoints with strict local trust requirements.

Operationally, the real difference is how the organisation handles recovery, device lifecycle, and trust boundaries. For synced passkeys, administrators should define where synchronisation is allowed, what device posture is required, and how account recovery is approved. For device-bound passkeys, teams need strong device enrolment, loss handling, and replacement workflows. The NIST Cybersecurity Framework 2.0 is useful here because it encourages identity governance that is tied to asset management and recovery, not just the login ceremony itself. The Ultimate Guide to NHIs - What are Non-Human Identities also highlights a related truth: credentials with broader mobility require stronger visibility and stricter lifecycle control.

• Use synced passkeys when user continuity and fast recovery are business priorities.
• Use device-bound passkeys when locality, endpoint control, and containment matter more.
• Pair either model with phishing-resistant MFA policy, device posture checks, and documented recovery.
• Treat synchronisation services as part of the trust boundary, not as a neutral transport layer.

These controls tend to break down in bring-your-own-device environments with weak enrolment standards because the organisation cannot reliably prove which endpoints hold the credential.

Common Variations and Edge Cases

Tighter containment often increases operational overhead, requiring organisations to balance security preference against user support and recovery cost. That is why the best practice is still evolving rather than universally settled. Some organisations allow synced passkeys for general workforce access but restrict device-bound passkeys to administrators, finance systems, or high-impact applications. Others do the reverse in highly regulated settings, where local custody is preferred even if recovery becomes slower.

There are also important edge cases. A synced passkey may still be acceptable if the ecosystem provides strong hardware-backed protection, transparent recovery controls, and robust device revocation. A device-bound passkey may be the wrong choice if users commonly switch endpoints, lose devices, or rely on shared workstations. The question is not which model is more modern. The question is which model matches the organisation’s tolerance for portability, account recovery risk, and containment.

For broader identity governance, the same logic applies to secrets and NHI lifecycle design: if a credential moves, it needs tighter monitoring; if it stays local, it needs stronger replacement and offboarding workflows. That is why passkey policy should be written together with account recovery, endpoint trust, and exception handling rather than as a one-line authentication rule. For security teams, the practical decision is usually less about the passkey type itself and more about how much trust can safely be delegated beyond the endpoint without weakening control.

Related resources from NHI Mgmt Group

• What is the difference between device-bound and synced passkeys?
• What is the difference between device binding and full identity assurance?
• What is the difference between passwordless authentication and full ransomware resistance?
• What is the difference between adaptive authentication and Zero Standing Privilege?