Why passkeys are safer
- Nothing to steal from us. We only store a public key. The private key stays on your device or in your password manager.
- Phishing-proof. A passkey only works on the real PasswordPal website. A look-alike site can't use it.
- Two factors in one. You need the device and your fingerprint, face or PIN, so signing in with a passkey doesn't also ask for a 2FA code.
Sign in — and, on supported devices, unlock
Your vault is encrypted with a key that comes from your master password, so a normal passkey can sign you in but can't decrypt your vault. PasswordPal goes further on devices that support the WebAuthn PRF extension (for example many recent Apple, Android and Google Password Manager passkeys, and modern security keys): your passkey also produces a secret that unlocks a protected copy of your vault key. On those devices, a passkey is all you need.
| Your passkey shows… | What it does |
|---|---|
| Signs in & unlocks vault | Log in and open your vault with your fingerprint, face or PIN alone. |
| Sign-in only | Log in without a password or 2FA code, then type your master password to unlock. |
PasswordPal tells you which kind you have as soon as you add it.
Adding a passkey
- Open the account menu → Security, 2FA & passkeys.
- Under Passkeys, choose Add a passkey and confirm your master password.
- Follow your device's prompt — Face ID, Touch ID, Windows Hello, your phone (scan a QR code) or a security key.
- If your device supports unlock, confirm once more. Done.
Next time, choose Log in with a passkey on the login screen. You can add up to 10 passkeys — one for each device is a good idea.
Keep your master password and recovery key safe even if you use passkeys. A passkey can be lost along with a device; your master password can't.
Questions
Which devices work?
Any modern browser on Windows, macOS, iOS, Android or Linux that supports passkeys, plus FIDO2 security keys. Passkeys require a secure (https) connection.
Is a passkey stored by PasswordPal?
Only its public half. The private key never leaves your device or the password manager that syncs it (such as iCloud Keychain or Google Password Manager).
What if I lose the device?
Log in with your master password (and 2FA if it's on), then remove the lost passkey under Settings → Security.
Can a passkey replace 2FA?
Yes — signing in with a passkey already requires something you have (the device) and something you are or know (biometric or PIN).