A passkey is a FIDO based sign-in credential kept on a phone, computer or hardware key and unlocked with your biometric, PIN or pattern. For developer accounts it blocks phishing because it only works on the real site. Decide whether to use a synced passkey or a device bound key, and plan recovery before you switch.
What a passkey is
Per the FIDO Alliance, a passkey is a sign-in credential based on FIDO standards. It lives on a phone, a computer or a hardware security key. You approve a sign-in by unlocking the device, and you do not type a username or password.
Under the hood, sign-in is a challenge and response using public key cryptography. Each passkey is unique to one site or app. There is no shared secret for an attacker to steal from a server, and a look-alike domain cannot use your passkey because the credential is bound to the real one.
Synced or device bound
This is the choice that matters for developers.
- Synced passkeys. Created on one device, they sync to your other devices through the same passkey provider, as long as each is signed in to your account. Providers can be built into the operating system or browser, or be a third party app. The FIDO Alliance describes this syncing as end to end encrypted, and a new device set up with your provider gets your passkeys.
- Device bound passkeys. These are on hardware security keys and do not sync. They stay on one device.
Synced passkeys are easier to recover from a lost phone. Device bound keys give a tighter guarantee that the secret never left the hardware. NIST's digital identity guidelines draw a similar line: at the highest assurance level, the text I reviewed says syncable authenticators shall not be used and the private key must be non-exportable. Check the current published text for your use case.
A sensible setup for a developer
- Use a synced passkey for everyday accounts, so your phone and laptop both work.
- Add a hardware security key as a second credential for the accounts that can ship code: source control, package registry, cloud console and CI.
- Keep a recovery path that does not depend on one phone. Store recovery codes offline.
- Remove SMS codes as a fallback once passkeys work.
Using the phone as the sign-in device
Many services let you sign in on a laptop by approving on a nearby phone. This is convenient, and it keeps the credential on the phone's secure hardware. Two cautions. First, a phone with a weak screen lock turns a strong credential into a weak one, so set a proper lock. Second, a phone that is lost or replaced must be removed from the account's list of credentials, so find where each service lists them.
What to plan for a team
- Decide which accounts require phishing resistant sign-in and by when.
- Pick your supported providers, so support is not guessing at each person's setup.
- Write a device loss procedure. See our lost phone playbook for engineers.
- Keep one break glass account with a hardware key in a safe, tested every few months.
Quick check
Are passkeys the same as a password manager entry?
No. A passkey is a public key credential bound to a site, with no shared secret to type or steal. Some password managers can store passkeys, but the credential itself is different from a password.
What happens if I lose the phone that holds my passkeys?
With a synced passkey, your other signed in devices still have it, and a new device gets it from your provider. With a device bound key, you need a second registered credential or a recovery code, so set those up first.
Sources
- FIDO Alliance: Passkeys
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management
Last reviewed: 19 October 2026.
