> Sigh. IT LITERALLY IS.

> The name "passkeys" itself means "exportable keys":

> https://fidoalliance.org/passkeys/

This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked. Nor did I see anything indicating that was a core part of their design from a cursory reading of the page, although I might have missed something. Your quote certainly doesn't imply 'exportable'.

Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended. To quote Tim Cappalli, who's credited on the W3C spec as an editor[1] and maintains passkeys.dev,[2] so presumably knows what he's talking about: "Passkeys should never be allowed to be exported in clear text."[3]

[1] https://www.w3.org/TR/webauthn/

[2] https://passkeys.dev/about/

[3] https://github.com/keepassxreboot/keepassxc/issues/10407

> This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked.

I literally provided a citation.

> Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended.

A syncable credential is by necessity representable in clear text at some point. In comparison, resident WebAuthn private keys NEVER leave the secure device.

> [1] https://www.w3.org/TR/webauthn/

WebAuthn is a _superset_ of Passkeys. Here's the citation from your own linked page:

> This use case illustrates how a consumer-centric Relying Party can leverage the authenticator built-in to a user’s devices to provide phishing-resistant sign in using multi-device credentials (commonly referred to as synced passkeys). ... > A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.