Skip to content
SafeHanded Docs

Passkeys & unlocking

Requests are encrypted to your identity key. To read a submitted credential, your browser has to decrypt it — which means your identity key must be unlocked on that browser. This page explains how unlocking works and how it relates to revealing.

The three things involved

Section titled “The three things involved”
  • Identity key — the key requests are encrypted to. It lives only in encrypted form on the server; the server can never decrypt it.
  • Passkeys — used to sign in and to confirm sensitive actions (a “step-up”). A passkey can also unlock your identity key, but only if it supports the WebAuthn PRF extension (below).
  • Unlock methods — the ways to open your identity key on a new browser: your recovery code (always) and any PRF-capable passkey you’ve enabled.

Enabling a passkey as an unlock is not the same as unlocking your key on this browser. Enabling one now also unlocks this browser, but they’re different actions.

Why PRF matters

Section titled “Why PRF matters”

A passkey can unlock your key only if it can return a PRF value — a stable secret the app derives from the passkey and uses to unwrap your key. Signing in doesn’t need PRF; unlocking does. That’s why a passkey can be “sign-in only” even though it logs you in perfectly.

The app can’t always tell whether a passkey supports PRF until it tries, so click Use to unlock and it will attempt it. If it works, the passkey shows Opens your vault; if not, it stays Sign-in only with a clear message.

Which passkey providers can unlock changes over time. We keep a single maintained list rather than scatter vendor names through the docs — see Passkey compatibility.

Revealing

Section titled “Revealing”

Once your key is unlocked on a browser, revealing a credential still prompts for a passkey each time. That step-up is phishing-resistant and single-use. See Revealing a credential.

Adding a passkey on a new device

Section titled “Adding a passkey on a new device”

Adding a second or later passkey asks you to confirm it’s you first, before the new passkey is created. Choose Use an existing passkey, or Email me a code to get a six-digit code at your sign-in address — handy on a phone when your other passkey is on a work laptop. We email you whenever a passkey is added. After adding one, use Use to unlock to enable it for reveals if its provider supports PRF; that step needs a passkey that already unlocks your key, or your recovery code.

If you’ve lost your passkey

Section titled “If you’ve lost your passkey”

On the Keys page choose Add a passkey, then Lost your passkey? Use your recovery code instead. Your recovery code confirms it’s you in place of the lost passkey. Create the new passkey, then remove the lost one.

An Owner can also reset your passkeys from the Members page. That removes all of them and signs you out; you add a new passkey at your next sign-in and unlock your key with your recovery code. See Members, roles & teams.

If you get stuck

Section titled “If you get stuck”

Common situations — “sign-in only”, “key not available in this browser”, enabling a new unlock — and how to get out of them are collected in Troubleshooting: I can’t reveal.

Section titled “Related”