How Passkeys Sync via iCloud Keychain in iOS 16

Passkeys in iOS 16 replace traditional passwords by using public-key cryptography to provide a faster, safer, and phishing-resistant login experience. When you create a passkey on an Apple device, it is automatically synchronized across your other Apple devices using iCloud Keychain. This seamless synchronization relies on end-to-end encryption to ensure that credentials remain private, accessible only on your trusted devices, and completely unreadable to third parties, including Apple.

The Underlying Technology: Public-Key Cryptography

Every passkey consists of a cryptographic key pair: a public key and a private key.

  • The public key is registered with and stored on the website or app's server.
  • The private key is generated uniquely on your device and never shared with the server.

During authentication, the server sends a cryptographic challenge to your device. The device signs this challenge using the private key and verifies the action via Face ID or Touch ID. Because the private key never leaves the device ecosystem, data breaches on the server side cannot expose your login credentials.

How iCloud Keychain Enables Synchronization

To make passkeys convenient, iOS 16 uses iCloud Keychain to distribute the private keys across your Apple hardware, eliminating the need to register a new passkey on every single device you own.

  1. End-to-End Encryption (E2EE): When a passkey is saved, it is encrypted before leaving the device. The encryption keys are derived from your device passcodes and hardware security features. Apple cannot view or decrypt your passkeys as they transit through or reside on iCloud servers.
  2. Device Peering via iCloud: Trusted devices linked to your Apple ID form a secure circle. When a new passkey is created on an iPhone running iOS 16, it is encrypted and pushed via CloudKit to your other devices running iOS 16, iPadOS 16, or macOS Ventura.
  3. Hardware-Backed Protection: Passkeys rely on the Secure Enclave, a dedicated security coprocessor in Apple hardware. The Secure Enclave handles cryptographic operations securely, preventing software-level tampering or extraction.

Account Recovery and Cross-Platform Use

If you lose an Apple device, your passkeys remain safe in iCloud Keychain. You can restore them to a new device by signing in with your Apple ID and completing two-factor authentication along with your existing device passcode.

For signing in on devices outside the Apple ecosystem (such as a Windows PC or an Android tablet), iOS 16 supports cross-device authentication. A website on a non-Apple device displays a QR code, which you scan using your iPhone's camera. The devices establish a local, encrypted connection via Bluetooth and WebAuthn standards, allowing your iPhone to approve the login securely without transferring the passkey off the device.