Synced passkeys are passwordless login credentials that can be securely copied across a user’s approved devices through a cloud sync service. They still rely on public-key cryptography, so the private key is not exposed like a password, but the credential is no longer locked to one physical device.
They matter because they reduce phishing and credential theft, yet they also expand the trust boundary. If an attacker compromises a laptop or browser profile, malware may abuse local authentication flows, account state, or device unlock mechanisms to use a synced passkey. Defenders should treat endpoint compromise as an identity risk: keep devices patched, harden browsers, monitor sessions, and revoke access or re-enroll credentials when a trusted device is suspected to be infected.