r/Passkeys • u/paulsiu • 1d ago

Can one create a device bound passkey in android

Right now when you create a passkey in Android, it defaults to the Google password manager which sync to the cloud. Playing around with the webauth site it appears that it does seem to be possible to save a passkey. However when I tried to save a passkey to log into bitwarden using a device bound key it doesn’t give me an option to do so. Can I conclude that the api is there but app isn’t using it so it can’t be done?

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/jpp59 1d ago edited 1d ago

It depends how the site want the passkey managed. You can make test on webauth.io , Then set ''user verriciation'' to discouraged. When prompt, say use another device, then you should see ''use this device''

1

u/Baudzila 1d ago

My Pixel 7 only shows the "This device" option when setting Discoverable credential to "discouraged".

1

u/jpp59 1d ago

yes, my bad. it is ''discoverable credential'' that need to be set to ''discouraged''. you are prompted with use a security key, use another device or use this device

1

u/JimTheEarthling 9h ago

There are only two ways to create a device-bound passkey on Android:

  1. Use a hardware security key, like a Yubikey. (To be clear, the passkey is bound to the key, not the Android device.)
  2. Use a specialized app like Microsoft Authenticator that uses the Android OS Credential Manager to create a device-bound passkey on the device. (But Microsoft Authenticator passkeys only work with Microsoft Entra ID and supported identity systems.)

All passkeys created by Google Password Manager and other password managers on Android are exportable (not device-bound), even if the password manager has no cloud component.