Cross-platform passkeys in 2026: what changed with the specification

On 25 August 2026 WebAuthn Level 3 reached W3C Recommendation status — the specification stopped being a draft. The previous level was approved in April 2021, so the gap ran to more than five years.

What Level 3 adds: the hybrid transport (signing in on someone else’s computer using your phone), related-origin requests, the getClientCapabilities() method, signal methods, and backup flags.

Those last are the most useful thing a site can learn about a credential. Per the specification, BE=1, BS=1 means the key is syncable and already backed up to a cloud, while BE=0, BS=0 means it is bound to one device and is going nowhere. The BE flag is set at creation and cannot change.

Practically: a site can distinguish a credential the user will lose along with their phone from one that will be restored. That changes whether a fallback sign-in path is needed.

Per caniuse as of 24 August 2026, passkeys are fully supported by browsers accounting for 93.07% of global page views. Partial support is zero.

First fully supporting versions: Chrome and Edge 108, Safari 16.1, iOS 16.0, Firefox 122, Samsung Internet 21. Never supporting: Internet Explorer, Opera Mini, the stock Android browser, UC Browser, QQ, Baidu, KaiOS.

WebAuthn as such sits separately: 92.41% full support plus 3.25% partial — the difference from passkeys being that WebAuthn worked with physical USB keys before syncable credentials existed.

This is not an adoption figure. 93% means "the browser can", and says nothing about how many sites offer passkeys or how many users have created one. The gap between those quantities is a subject of its own.

It is easy to form a wrong picture here, because sources disagree and Microsoft’s wording invites confusion.

The support matrix at passkeys.dev (updated 20 May 2026) states that synced passkeys are not supported on Windows. That is out of date. The accurate picture is two separate things:

• Windows Hello passkeys are indeed device-bound — Microsoft’s own wording, 7 May 2026.
• But Microsoft Password Manager in Edge 142 does sync passkeys through the Microsoft account cloud — announced 3 November 2025. With two limits: not on mobile, and not for Entra accounts.

The trap is in the phrasing. A sentence like "a passkey from one device can be used to sign in on another" reads as sync but describes QR or Bluetooth cross-device authentication, where the credential moves nowhere and the second device merely confirms. These are different mechanisms with different consequences: lose the phone and in the first case you lose access, in the second you do not.

The Credential Exchange Format (CXF) version 1.0 is a Proposed Standard with errata dated 9 March 2026. But the Credential Exchange Protocol (CXP), which actually moves the credentials, is still a Working Draft from 3 October 2024.

In practice: Apple shipped app-to-app import and export in OS 26, Google shipped on Android, and Microsoft has no confirmed implementation.

For anyone choosing where to keep credentials: portability is not yet guaranteed. A passkey created in one ecosystem will most likely stay there, and that is worth weighing before switching off a password.

Sources: WebAuthn Level 3, caniuse, the passkeys.dev support matrix, Microsoft on Edge sync.