/
Menu

Passkeys

Add and remove passkeys, why you should have two, and what the passkey check is.

Passkeys unlock your vault. Each one holds its own wrapped copy of the vault key, so any single passkey is enough. This page helps you manage them.

#Why you should have two

If you have one passkey and lose that device, your recovery key is the only way back in. A second passkey on another device, such as your phone or a security key, removes that single point of failure. Settings shows a warning while you have only one.

#Passkey checks

Changes to your passkeys need a fresh passkey check: a passkey prompt that proves it is you, even though you are signed in. Each check works once.

#Add a passkey

  1. Open Settings, then Security, and find Passkeys.
  2. Choose Add passkey.
  3. Approve your browser's three prompts: an existing passkey approves, then you create the new one, then you confirm it.

Use the device you want the new passkey on. A new passkey is named after the device, for example "Mac passkey".

#Remove a passkey

  1. In Passkeys, find the one to remove and choose Remove.
  2. Choose Remove passkey and approve the passkey check.

The passkey no longer unlocks your vault. You can't remove your only passkey: add another first.

#Which passkeys work

Your vault needs a passkey that your browser and provider can use to make the vault's secret. Setup checks your browser before it creates a passkey. A phone passkey scanned by QR code may sign you in but not open the vault. Use a passkey that works in that browser, or your recovery key.

#If a device is lost

  1. Remove its passkey.
  2. Rotate your vault key.
  3. Rotate the credentials stored in the vault. See playbooks.

#If something goes wrong

  • The prompt closed. Nothing changed. Try again.
  • "Add another passkey before removing this one." You have only one. Add a second first.