What is a passkey?
A passkey lets you sign in to LockPass without typing your master password, relying instead on a strong authentication mechanism already present on your device.
The following methods are supported:
- Biometrics (fingerprint, facial recognition): phone, tablet, iCloud Keychain or Windows Hello;
- PIN code via Windows Hello;
- FIDO2 hardware key (USB security key, such as a YubiKey);
- Chrome profile (Google Password Manager).
LockSelf's Zero Knowledge model is preserved: the passkey replaces the daily entry of your master password; it gives no access to any data in clear text on the server side.
Who can use passkeys?
All users can set up and use their own passkeys from their personal settings, whatever their role. Only Super Admins and administrators of a parent or semi-autonomous organization can additionally enforce passkey setup across the organization.
Creating a passkey
Passkeys are created from the web app.
- Open the passkey management section in your personal settings.
- Click “Add a passkey”.
- Enter the 6-digit code received by email, then click “Confirm”.
- Give your passkey a name (255 characters maximum), then click “Confirm”.
- Follow your browser's instructions to choose where to save the passkey and confirm with the method of your choice.
Your passkey then appears in the list, with its creation date, its last use and an indication when it is the one used for the current session. You also receive a confirmation email.
You can register up to 5 passkeys per account. Beyond that, the add button is disabled.
Signing in with a passkey
Once at least one passkey is registered:
- Enter your email address on the sign-in screen (then your MFA if it is enabled).
- Click “Sign in with a passkey”.
- Confirm with the method associated with your passkey (fingerprint, face, PIN code, USB key, and so on).
Signing in with your master password always remains available: you can switch from one method to the other at every sign-in.
From the browser extension
The extension lets you sign in with a passkey that already exists. Creating a passkey is only possible from the web app.
Renaming or deleting a passkey
Renaming
- In your passkey list, click “Rename”.
- Enter the new name (255 characters maximum, unique among your passkeys).
- Confirm.
Deleting
- In your passkey list, click “Delete”.
- Read the warning displayed: if the passkey is used for the current session, deleting it signs you out.
- Enter the code received by email to confirm the deletion.
You receive a notification email after every rename and every deletion.
When your organization enforces passkeys
Your administrator can enforce passkey setup for every user in the organization, with a grace period to give you time to get set up.
In that case:
- you receive an email inviting you to set up a passkey;
- at the end of each sign-in with your master password, a window offers to create one. You can click “Continue”, “Skip for now” or “Don't ask me again for 30 days”;
- reminders are sent before the deadline, including one at D-3;
- when the period expires, setting up a passkey becomes mandatory in order to access the application.
Enabling enforced setup (administrators)
- Go to Administration > Authentication.
- Enable the “Enforced setup” option for passkeys.
- Read the warning displayed, then confirm.
Enabling it immediately signs out all users except the Super Admin. An email is sent to users who do not yet have a passkey. Administrators and the Super Admin are not blocked when the period expires, so that administration remains possible at all times.
Administrators of a limited organization have no access to Administration > Authentication: their organization inherits the configuration set by the parent organization.
Frequently asked questions
My browser does not offer passkey sign-in
If your browser does not support WebAuthn, an explicit message is displayed. Signing in with your master password remains available. Private browsing may also prevent the use of a passkey.
I deleted my last passkey while they are mandatory
You are signed out and will have to set up a new one at your next sign-in in order to access the application.
Can I register more than 5 passkeys?
No. The limit is 5 passkeys per account.
I received a security alert about a passkey
An alert email is sent when suspicious use or an attempted use is detected. Sign in to the web app to review your passkeys and delete the one concerned, then set up a new one.
Updated