Engineering secure passkey sync in Microsoft Password Manager

Passkeys are designed to replace passwords with strong, phishing-resistant credentials that make sign-in quick, easy, and secure. With Microsoft Password Manager, users can now save and sync passkeys across devices signed in with their Microsoft account.

Syncing passkeys enables a seamless sign-in experience, allowing users to access their credentials wherever they are signed in. Instead of being tied to a single device, passkeys can be securely available across devices while continuing to leverage device-based authentication such as biometrics or PIN.

However, enabling this experience requires a thoughtful approach to security. Roaming cryptographic credentials must be protected during creation, sync, and recovery without weakening their security properties.

In this post, we’ll walk through the architectural principles that power passkey syncing in Microsoft Password Manager.

Architecture overview

Passkey syncing in Microsoft Password Manager is built on a layered architecture…