Saving and using passkeys

A passkey replaces your password. You log in by confirming with your fingerprint, your face, your PIN or your master password. A passkey only works on the real address of the website, so not on a fake site. You can read how that works in the lesson Passkeys and security keys of the Safe online course and in Password manager and passkeys: how to log in securely.

Where do you store a passkey?

• In your password manager (Bitwarden, KeePassXC): the passkey goes with you to all your devices that have your manager, and it is included in your backup.
• In the account of your phone or computer (Google, Apple, Microsoft): handy within one brand.
• On a security key: the passkey cannot be taken off it. So always register at least two keys.

Choose one fixed place. That way you will know later where your passkey is.

With Bitwarden

1. Make sure saving and using passkeys is switched on in the settings of the browser extension.
2. On a website, go to your account settings and choose to add a passkey.
3. Bitwarden offers to save the passkey. Choose an existing item for this website or a new item. Want to store it somewhere else? Then choose the option for your device or your security key.
4. Logging in: on the website, choose to log in with a passkey and confirm in Bitwarden.

An item in Bitwarden holds one passkey. On Android (version 14 and later) and the iPhone (iOS 17 and later), you can set Bitwarden as the place for your passkeys. The app helps you with this in its settings.

With KeePassXC

1. In the settings of the KeePassXC-Browser extension, switch on support for passkeys.
2. Add a passkey on the website and confirm in KeePassXC. KeePassXC creates a new item with (passkey) after the title.
3. Logging in: on the website, choose to log in with a passkey and confirm in KeePassXC.

Under Database, Passkeys you can see all your passkeys. You can also export and import them there. Such an export file is not encrypted: do not keep it.

Good to know

• Your passkey is included in the JSON export of Bitwarden, not in the CSV export (see Making a backup or export of your vault).
• Your password often keeps working alongside the passkey. So keep it long and unique.
• A passkey in your manager is only as safe as your manager. Protect your vault with a strong master password and two-step login.

At WebOké

In Nextcloud you can log in with a passkey or security key, using passwordless login (see Password manager and passkeys: how to log in securely). My WebOké does not work with passkeys: there you use your password with a login code by email or an authenticator app (see The login code by email (two-step verification)).