Signing in and unlocking
How to sign in with a passkey, an email code or GitHub, and the difference between a signed-in but locked session and an unlocked vault.
StackHangar separates two things. Signing in shows the server who you are. Unlocking opens your encrypted vault on your device. Only a passkey (or your recovery key) unlocks.
#Signed in but locked, or unlocked
| State | What you can do |
|---|---|
| Signed out | Nothing. You see the sign-in page. |
| Signed in, locked | You see the Unlock your vault screen. Nothing in the vault is readable. |
| Unlocked | You use the app. Values are decrypted on your device. |
#Ways to sign in
#Sign in with passkey
On the sign-in page, choose Sign in with passkey. Your device shows your passkeys. Choose one and approve it. This signs you in and unlocks the vault in one step. It is the everyday way in. It needs no email address.
If this browser can't use passkeys, the button is disabled and the page says so.
#Email code
- Enter your email address and choose Continue with email.
- Enter the 8-digit code from the email and choose Continue.
You are signed in but locked. Next, unlock with a passkey on the Unlock your vault screen. You can't resend a code for a minute after sending one, and a new code makes earlier codes stop working. Tick Remember email to have the address filled in next time.
#GitHub
Choose Continue with GitHub. Your GitHub email must be verified and must match your StackHangar account. You are signed in but locked. Unlock with a passkey next.
Note
An email code or GitHub alone never opens the vault. This is deliberate: your vault is only as safe as the passkey that unlocks it, not your email or GitHub account.
#Why email and GitHub exist at all
A passkey can't create an account, because StackHangar needs a verified email for alerts. Email and GitHub are also the first step of recovery, and they get you signed in on browsers where the passkey button can't open your vault. See recovery key.
#Locked screen
On Unlock your vault, choose Unlock with passkey. The screen also offers Lost your passkeys? for recovery, and Sign out if the vault isn't yours. For how long the vault stays open afterwards, see unlocking.
#If something goes wrong
- "This browser can't unlock your vault with that passkey." Some browsers, and a phone passkey scanned by QR code, don't pass the secret the vault needs. Sign in with an email code or GitHub, then use a passkey that works in this browser or your recovery key.
- "Too many attempts." Wait the number of minutes the page shows and try again.
- GitHub sign-in didn't work. Make sure your GitHub email is verified, or use an email code.
- You were signed out. After 12 hours, or after being idle past your idle time, you sign in again. The sign-in page says which.
See troubleshooting for more.
Something missing or wrong on this page? Tell us.