BE and BS Flags Explained: Telling a Synced Passkey from a Device-Bound One

This article explains the WebAuthn BE (Backup Eligibility) and BS (Backup State) flags, how to read them from the authenticator-data flags byte, the meaning of each valid combination (device-bound, syncable-but-not-backed-up, synced) and the invalid BE=0/BS=1 state, and provides operational guidance: store BE at registration, re-read BS on every assertion, reject impossible combinations, and use these flags to drive recovery and policy decisions while avoiding common implementation mistakes.