I think I’ve worked this out but could someone just confirm it please?
Passkeys need to be set up separately on each device on which you use them.
In other words you can’t set up a Passkey on one device then sync it across all the others you use.
Thanks
There are two types of passkeys, syncable and device-bound.
Bitwarden inherently supports only syncable. Yubikey is an example of device-bound.
Thank you for the reply.
I’m not sure you’re correct in stating that Bitwarden is inherently syncable or indeed that Passkeys are syncable across devices.
This extract from the article you linked to seems to be in line with my experience that they are unique to a single device i.e PC, Phone, Tablet etc.
User’s device creates a new public/private key pair (passkey) unique for the local device, online service and user’s account.
When I went onto my Amazon account on my Win10 PC, I created a Passkey for Bitwarden. Then used it to log into Amazon on the same PC. However, if I tried to log into Amazon on my Android 14 phone then an error message stating the passkey was incorrect was shown.
If I log onto Amazon on my phone then create a Passkey I can then use that on my phone to log in without error. In fact my Amazon Account then shows that I have two Passkeys.
From Bitwarden’s Passkey FAQ:
…Passkeys are often able to sync across your devices, however not all platforms support this yet. …
Do I use the same passkey regardless of the browser I’m on or will each site require a different passkey depending on the browser or device?
The passkeys stored in Bitwarden are synced passkeys, meaning that any browser where you are logged into the Bitwarden extension or where you have the Bitwarden mobile app installed, you can access your accounts using the same passkeys without needing to create new ones. If you don’t store your passkeys in Bitwarden it will depend on how well the browser integrates with your device OS (where the passkeys are stored).
Bottom line, though, Passkeys remain a “work in progress” both within Bitwarden and industry-wide. Support for them is nowhere near universal, and there are often variations in how they behave from site-to-site.
I note that the excerpted text was present on this webpage as far back as 2017, which was before the FIDO Alliance introduced discoverable credentials (resident keys) and before publication of the CTAP2 standard. It may be possible that this description is outdated, and not applicable to syncable passkeys (such as those used by Bitwarden).
Alternatively, the mention of “local device” may be a reference to the metadata that specifies the Authenticator Attestation GUID (AAGUID), which is unique to the authenticator hardware model or authenticator software platform.
This article explains the different between hardware-bound and syncable (multi-device) passkeys. It’s fairly clear that the requirement for a passkey to be “unique for the local device” is only applicable to hardware-bound passkeys.