Crypto binding is the technique of cryptographically tying a credential, session, or identifier to a specific device (using a device-held key) so it can’t be copied, cloned, or used elsewhere. It’s what turns a spoofable, attribute-based device signal into a tamper-resistant, high-assurance device identity, and it underpins the security of passkeys and durable device recognition.

The core idea: instead of trusting attributes that can be faked, the device proves it holds a secret key that lives only on that device, something an attacker can’t reproduce by copying observable traits.

How crypto binding works

The device generates a cryptographic key pair, ideally storing the private key in secure hardware (a secure enclave or trusted platform module) where it can’t be extracted. The public key is registered with the service. Afterward, the device proves its identity or binds a credential by signing challenges with the private key; the service verifies the signature with the public key. Because the private key never leaves the device and can’t be copied, anything bound to it (a passkey, a device identity, a session) is tied to that specific hardware.

Why it matters

Crypto binding closes gaps that attribute-based signals leave open. A device fingerprint can be spoofed by an anti-detect browser; a cryptographically bound device identity cannot, because faking it would require the device’s private key. This makes crypto binding valuable for durable device recognition, for binding passkeys and credentials so a stolen credential can’t be used on another device, and for establishing genuine device trust in risk decisions. It’s the same public-key principle that makes passkeys phishing-resistant, applied to binding identity to hardware.

Where it’s used

Crypto binding appears in passkeys and FIDO2 (the credential is bound to the device’s key), in web and mobile device identity (using web-crypto APIs or secure enclaves to create a durable device ID), and in session and transaction binding for high-assurance actions. Transmit Security’s web-crypto approach to device ID is one example of applying crypto binding to make device recognition tamper-resistant. As a building block, crypto binding is what elevates device signals from "probably the same device" to "provably the same device."

Frequently asked questions

What is crypto binding?

Cryptographically tying a credential or identifier to a specific device via a device-held key, so it can’t be copied or used elsewhere.

How does crypto binding work?

The device holds a private key (ideally in secure hardware) and signs challenges to prove identity; only the public key is stored server-side.

Why is crypto binding more secure than fingerprinting?

Fingerprints can be spoofed by faking attributes; a crypto-bound identity can’t be cloned without the device’s private key.

Related: Device Identity / Device ID · Passkeys · Device Fingerprinting · FIDO2 · WebAuthn