Passkeys are everywhere now. Apple, Google, Microsoft are all pushing synced passkeys to consumers. Why does Yubico insist that device-bound, hardware passkeys are fundamentally different?

While mobile-based passkeys (synced via iCloud/Google/Microsoft) are considered high-security (AAL2), they remain vulnerable to OS alteration by virus, malware, backdoor. Hardware keys (isolated secure element) are the only way to achieve Authenticator Assurance Level 3 (AAL3), the gold standard for high-value corporate accounts. Below is a comparison of storing passkeys on various devices for your reference:

Please note that platform passkeys on a PC or mobile phone can still be compromised by remote control malware; therefore, a hardware token (out of band) like a YubiKey remains the gold standard because it requires the user’s FIDO hardware and presence (touch) to authenticate. See how a malware scammer steals your money.