Synced and hardware passkeys
The difference between a passkey your keychain syncs and one that stays on a security key, what identity records about each, and what each gives you today.
On this page
All passkeys work the same way at sign-in. They differ in where the private key lives, and that decides what happens when a device is lost and how much trust the key can earn.
The two types#
| Synced passkey | Hardware passkey | |
|---|---|---|
| Where the private key lives | In a password manager or your device's platform keychain. | Inside a security key or another device-bound authenticator. |
| Can it be copied to other devices? | Yes, by the keychain or password manager, to the devices on that account. | No. It stays on the device. |
| If you lose the device | You can still use the passkey from another device that syncs. | You lose that passkey. You need another way in. |
| What protects it | Your keychain's own account protection, plus the device lock on each device. | The physical key, plus a PIN or touch on the key. |
| Convenient for | Everyday use across your own devices. | A spare, or for people who want a key that cannot be copied. |
Identity does not choose for you. Which type you get is decided by your device and browser when you add the passkey. A security key gives a hardware passkey. A passkey saved to a password manager or a platform keychain is usually a synced one.
What identity records#
When you add a passkey, your device reports two facts, and identity records them with the passkey.
- Whether the passkey is eligible to be backed up, that is, whether it is the synced kind.
- Whether it is currently backed up.
It does not use these facts to refuse a passkey. Both types are accepted and both reach the same level today.
What each gives you today#
Both reach AAL2, because identity requires the device to check you each time a passkey is used.
AAL3 is reserved for a passkey that cannot be exported and whose device make has been verified. Identity does not verify device attestation yet, so a passkey is never recorded as verified, and no sign-in reaches AAL3 today, whichever type you use. Status: Planned. A hardware passkey today is the same as a synced one in terms of level. Its advantages are the ones in the table above, not a higher number.
Counters and cloned keys#
A hardware key keeps a count of how many times it has signed, and a count that goes backwards can mean the key was cloned. If a passkey is refused for a reason like this, you see the ordinary message The passkey did not work. Try again or use another method., and you can use another method or remove and re-add the passkey.
Choosing#
- Add at least two passkeys. If the one you use is a hardware key, make the second a synced one, or the reverse. Losing a single hardware key with nothing else set up means you need recovery.
- Name each passkey for the device or key it lives on when you add it, so you can tell them apart in your list. See Security and passkeys.
- If you remove a passkey you no longer own, your device may still list it until you delete it there too.