What is a passkey?
A passkey is a device-bound key that replaces (or supplements) your password. Your device generates a unique cryptographic key pair and keeps the private half safe — protected by your fingerprint, face, or device PIN. You almost never type a password when you sign in with a passkey. (There are some rare exceptions related to forgotten-password recovery.)
What it does
- Signs you in without typing a password.
- Resists phishing: a passkey is bound to this site and can't be tricked into signing you in to a fake one.
- If your passkey is PRF-capable, it can also unlock your Trove content on the device where it was registered — no password (or Trove Unlock Password) needed. (PRF stands for Pseudo Random Function, and is not a feature all Passkey providers have. If your passkey provider is not PRF-capable, and you may be prompted to type your password in order to unlock your troves even after successfully logging in with your passkey.)
When to use it
- On every device you regularly use. Registering a passkey per device is the fastest, safest way to sign in.
- Especially if you've enabled a Trove Unlock Password — a PRF-capable passkey saves you from typing it.
Tradeoffs
- A passkey lives on the device (or synced across your platform's ecosystem). Losing the device means losing that passkey.
- Not every browser or authenticator supports PRF. Non-PRF passkeys still work for sign-in but can't unlock Trove content.
If you lose access
You can still sign in with your password. Register a new passkey on your replacement device. Remove the lost device's passkey from the Manage Passkeys page. Losing all your passkeys does not lose your Trove content, provided you still have either your password or a recovery code.