--- title: BE and BS Flags Explained: Telling a Synced Passkey from... description: WebAuthn's authenticator data flags byte contains two bits that reveal whether a passkey is synced or device-bound: BE (Backup Eligibility, bit 3, 0x08) is... canonical: https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One | daily.dev og:description: WebAuthn's authenticator data flags byte contains two bits that reveal whether a passkey is synced or device-bound: BE (Backup Eligibility, bit 3, 0x08) is... og:url: https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot og:image: https://api.daily.dev/og/posts/1ctD0d6oT.png og:image:alt: BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 14 min read · 0 upvotes · 0 comments ## Summary WebAuthn's authenticator data flags byte contains two bits that reveal whether a passkey is synced or device-bound: BE (Backup Eligibility, bit 3, 0x08) is permanent and indicates if a credential can ever be backed up, while BS (Backup State, bit 4, 0x10) is live and reflects current backup status. The four possible combinations produce three valid states and one invalid one (BE=0, BS=1) that relying parties must reject. Practical guidance covers how to extract these flags in JavaScript, how libraries like SimpleWebAuthn surface them, why BS must be re-read on every assertion (not just at registration), common mistakes like using signature counters for clone detection on synced passkeys, and how to build RP policy around each flag state to drive recovery UX and second-credential prompting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Passkey Recovery and Lockout: The Complete Guide for Relying Parties](https://daily.dev/posts/passkey-recovery-and-lockout-the-complete-guide-for-relying-parties-9r5gr95zb) · Security Boulevard · 0 upvotes · 0 comments - [Things I learnt about passkeys when building passkeybot](https://daily.dev/posts/things-i-learnt-about-passkeys-when-building-passkeybot-rw6rlip9s) · Hacker News · 2 upvotes · 0 comments - [Passkeys are Your New Best Friend](https://daily.dev/posts/passkeys-are-your-new-best-friend-qhqzjdn9d) · Tech Lead Digest · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#passkeys](https://daily.dev/tags/passkeys) [View this post on daily.dev](https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One","url":"https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot"},"datePublished":"2026-07-16T09:00:52.125Z","dateModified":"2026-07-16T09:01:18.289Z","description":"WebAuthn's authenticator data flags byte contains two bits that reveal whether a passkey is synced or device-bound: BE (Backup Eligibility, bit 3, 0x08) is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/be-and-bs-flags-explained-telling-a-synced-passkey-from-a-device-bound-one-1ctd0d6ot","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,passkeys","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One"}]} ```