I can't reveal a credential

The most common reveal problems, and what to do about each. Background: Passkeys & unlocking.

“This passkey shows Sign-in only and I want it to reveal.”

Its provider didn’t return a PRF value, so it can’t decrypt. Use a PRF-capable passkey, or unlock this browser with your recovery code.

“I typed my recovery code and it said the passkey returned no PRF value.”

That passkey can’t be an unlock method. But your key is now unlocked on this browser (from the recovery code you typed), so you can reveal here. To unlock elsewhere, use your recovery code or a PRF-capable passkey.

“Use to unlock launched Windows Hello / Touch ID — not the passkey I’m adding.”

Enabling a new unlock is a two-step ceremony: first it confirms with a method that already unlocks your key (an existing passkey — which may be Windows Hello or Touch ID — or your recovery code), then it prompts the new passkey to store its own copy. The first prompt is your existing unlock, not the new passkey. To skip it, type your recovery phrase and choose Unlock with recovery code for the first step.

“The Reveal button says Unlock your vault to reveal.”

This browser doesn’t have your key yet. Click it: the reveal window lets you unlock right there with a PRF passkey or your recovery code, then Reveal with passkey. Nothing is counted until the reveal itself.

“A red bar says This browser can’t open your vault.”

This browser holds an older key of yours but not your current one, so requests sent to you now can’t be opened here. Click Fix it: unlock again and unlock with a PRF passkey or your recovery code. The bar appears on every page until it’s fixed.

“An amber bar says my vault is locked.”

Nothing is wrong: this browser just hasn’t been unlocked yet. If credentials are waiting, the bar says how many. Unlock opens it in place; Not now hides the bar until you next sign in. (Under strict mode the vault is always locked between reveals, so the bar isn’t shown.)

Anything that needs your vault says so beside it while it’s locked, with its own Unlock: for example Wait until they’ve set up in a new share, the send button on a waiting share and Give the key.

“It says the credential is sealed to a key I no longer have.”

The credential was encrypted to a key you’ve since lost — for example after starting again with a new key. No browser can open it. The window names anyone else who can reveal it; otherwise click Request it again to send the subject a new request with the same details.

“It says the credential could not be decrypted and looks tampered with.”

The envelope was fetched but failed its integrity check. It’s recorded in the audit log. Tell your admin, and Request it again.

“Creating a request says a recipient’s key could not be verified.”

Nothing was sent. See How keys are checked for what each message means and what to do.

“It says this browser isn’t registered, or was revoked.”

Unlock your vault in this browser (the reveal window offers it); unlocking registers the browser as one of your devices.

“I’ve lost my passkey.”

On the Keys page choose Add a passkey, then Lost your passkey? Use your recovery code instead. Create the new passkey, then remove the lost one. An Owner can also reset your passkeys.

“My identity key can only be unlocked with my recovery code.”

With no PRF passkey enrolled, keep that code safe: losing it means you can’t open your key. Add a PRF-capable passkey as a second unlock when you can.

“I’ve lost my recovery phrase and every passkey.”

On the unlock screen choose Lost your recovery phrase and every passkey? to start over with a new key. You sign in again, type start over, and set up a new key. What only your old key could open stays closed; past secrets then need the other recipients or organisation recovery. New secrets reach you once an Owner or Admin approves your new key (or after 72 hours if nobody there can approve it, for example if you are the only Owner, who also needs a code texted to the mobile number on their account). Until then, finding your old key after all and using it (Use your previous key) cancels the start-over.

“My account is locked.”

Someone used This wasn’t me on a start-over of your account. Contact SafeHanded support; we check it’s really you before unlocking it.

“Your start-over was cancelled because your existing key was used.”

Your old key was opened (with a passkey, your recovery phrase, or a browser that still had it) while the start-over was waiting, so your old key is back and the new one is thrown away. If you didn’t start over yourself, change your email password: someone else may have access to it.

“Contact SafeHanded support” when starting over

You are the only Owner or Admin of an organisation and there is no mobile number on your account that was confirmed at least 7 days ago. See A mobile number for account security.

“It says Auto-destroy overdue.”

See Auto-destroy overdue — a credential past its retention deadline can no longer be revealed; this message just means the deletion sweep hasn’t run yet.

Still stuck?

Check passkey compatibility for your provider, or, if your key is truly lost, start over with a new key.