Sign in with a passkey

Sign in with a passkey • LockPass

What is a passkey?

A passkey lets you sign in to LockPass without entering your master password, using a strong authentication method already available on your device (WebAuthn standard).

The following methods are supported:

  • Biometrics (fingerprint, facial recognition): phone, tablet, iCloud Keychain or Windows Hello;
  • PIN code via Windows Hello;
  • FIDO2 hardware key (USB security key, such as a YubiKey);
  • Chrome profile (Google Password Manager).

LockSelf's Zero Knowledge model is preserved: the passkey replaces the daily entry of your master password, and gives no access to any unencrypted data on the server side.

Who can use passkeys?

All users, whatever their role (user, moderator, administrator, Super Admin), can set up, use and manage their own passkeys from their personal settings.

Only Super Admins and administrators of a parent or semi-autonomous organization can also:

  • require passkey setup across the organization;
  • monitor passkey adoption in their organization, through the dashboard and information emails.

Create a passkey

Passkeys are created from the web application.

  1. Open the passkey management section in your personal settings.
  2. Click "Add a passkey".
  3. Enter the 6-digit code received by email, then click "Confirm".
  4. Give your passkey a name (255 characters maximum, unique among your passkeys), then click "Confirm".
  5. Follow your browser's instructions to choose where to save the passkey and confirm with the method of your choice.

Your passkey then appears in the list, with its icon, creation date, last use and an indicator when it is the one used for the current session. You also receive a confirmation email.

You can register up to 5 passkeys per account. Beyond that, the add button is disabled.

If your organization requires a passkey, you can also create one directly from the window displayed at the end of your sign-in (see below).

Sign in with a passkey

Once at least one passkey is registered:

  1. Enter your email address on the sign-in screen (then your MFA if enabled).
  2. Click "Sign in with a passkey", offered by default.
  3. Confirm with the method linked to your passkey (fingerprint, face, PIN code, USB key…).

Signing in with your master password always remains available: you can switch from one method to the other each time you sign in.

If signing in with a passkey fails (passkey deleted from your device, timeout, private browsing…), an error message is displayed and you can go back to signing in with your master password.

From the browser extension

The extension lets you sign in with a passkey that has already been created. Passkeys can only be created from the web application.

Rename or delete a passkey

Rename

  1. In your passkey list, click "Rename".
  2. Enter the new name (255 characters maximum, unique among your passkeys).
  3. Confirm.

Delete

  1. In your passkey list, click "Delete".
  2. Read the warning displayed: if the passkey is used for the current session, deleting it will sign you out.
  3. Enter the code received by email to confirm the deletion.

If you delete your last passkey while your organization requires one, a message informs you that you will be asked to set up a new one the next time you sign in.

You receive a notification email after each rename and each deletion.

When your organization requires a passkey

Your administrator can require passkey setup for all users of the organization, with a grace period to give you time to get set up.

In this case:

  • you receive an email inviting you to set up a passkey as soon as the requirement is enabled;
  • at the end of each sign-in with your master password, a window offers to create one. You can click "Continue", "Skip for now" or "Don't ask again for 30 days";
  • if you still don't have a passkey, you receive a first reminder during the grace period, then an urgent reminder 3 days before the deadline;
  • when the grace period expires, setting up a passkey becomes mandatory to access the application: only creating a passkey and signing out remain possible.

Enable required setup (administrators)

  1. Go to Administration > Authentication.
  2. Enable the "Required setup" option for passkeys.
  3. Read the warning displayed, then confirm.

Enabling it immediately signs out all users, except the Super Admin. An email is sent to users (including those of dependent sub-organizations) who do not yet have a passkey.

Administrators and the Super Admin are not blocked when the grace period expires, to ensure continuity of administration.

Administrators of a limited organization do not have access to Administration > Authentication: their organization inherits the configuration set by the parent organization.

Frequently asked questions

My browser does not offer passkey sign-in

If your browser does not support WebAuthn technology, an explicit message is displayed with a link to support. Signing in with your master password remains available. Private browsing may also prevent the use of a passkey.

I deleted my last passkey while it is mandatory

You are signed out and will need to set up a new one the next time you sign in to access the application.

Can I register more than 5 passkeys?

No. The limit is 5 passkeys per account.

Are administrators subject to the requirement?

No. Administrators and the Super Admin are neither signed out nor blocked if they have no passkey when the grace period expires. They can, however, set up their own passkeys like any other user.

I received a security alert about a passkey

An alert email is sent in the event of suspicious use or attempted use. Sign in to the web application to check your passkeys and delete the one concerned, then set up a new one.

Updated