Sync Fabric.
A sync fabric is the service a passkey provider uses to store, transmit and manage synced authentication keys across a user's devices. Its security sets the real strength of a synced passkey.
Synced passkeys made passkeys usable at consumer scale, because losing a phone no longer means losing the account. The cost is that the private key now lives in a second place. NIST SP 800-63B-4's syncable authenticators appendix names that place the sync fabric and treats its protection as part of the authenticator's assurance.
The attack research in 2026 targets exactly this layer. Unit 42's "Pass the Passkey" did not break passkey cryptography; it went after the client and the secret protecting Google's synced keys, starting from malware already on the device. Anvil Secure's whitepaper puts the sync fabric next to the authenticator, the client, the relying party and recovery as a separate area for testers.
Our reading. A relying party cannot audit a platform's sync fabric, but it controls what happens around it. Watch for new-device and re-registration events, treat a passkey sign-in from a newly synced device as a fresh risk signal, and do not let account recovery fall back to a factor weaker than the passkey. For high-value actions, step-up authentication with a device-bound credential limits what a stolen synced key can do. Recovery patterns are in account recovery design, and the basics of synced versus device-bound keys are in passkeys explained.
Common questions
What is a sync fabric?
It is the cloud or hybrid service a passkey provider uses to copy a passkey's private key between a user's devices, such as a platform keychain or a password manager's sync service. NIST SP 800-63B-4 sets requirements for it: encrypted storage, access limited to the authenticated user, and AAL2-equivalent MFA to access it.
Is a synced passkey less secure than a device-bound one?
The cryptography is the same, but a synced passkey adds the sync fabric and every device on the account to the attack surface. Whoever can join a new device to the fabric, or extract the key that protects it, can use the passkey. Device-bound passkeys do not have that exposure, which is why some high-assurance uses require them.
What is an example of a sync fabric attack?
Unit 42's Pass-ta-key research, published August 3, 2026, showed attacks on Google Password Manager synced passkeys on Windows that start with malware on the victim's device. The most severe variant targets the 32-byte Security Domain Secret that protects synced passkeys; Unit 42 reported no way to rotate or revoke it under Google's implementation at the time.
Can a relying party tell if a passkey is synced?
Partly. WebAuthn exposes backup eligibility and backup state flags at registration and sign-in, which indicate whether a credential can be or has been synced. They do not tell the relying party which sync fabric holds it or how well it is protected.
Related terms
In the guides
Account Recovery Design: The Most-Attacked Flow in CIAM
The recovery flow is the security floor of the entire auth system. Email magic link on a passkey-secured account is, structurally, an email-secured account. Design recovery deliberately.
FIDO2 Explained: CTAP2, WebAuthn, and Where Security Keys Still Win
FIDO2 is the umbrella for WebAuthn (browser API) plus CTAP2 (the authenticator protocol). How the pieces fit, when to require security keys, and how passkeys changed the deployment model.
Passkeys Explained: How Synced Credentials Replace Passwords
Passkeys are the user-facing brand for synced WebAuthn credentials. A practical explanation of how they work, sync, recovery, and the deployment patterns that make adoption real.
Password Manager vs Passwordless: Two Genuinely Different Paths Past the Password
Password managers keep passwords; they just keep them well. Passwordless eliminates the password as a primitive. Both improve over typed passwords; the migration paths diverge.