Using passkeys

A passkey replaces a password with a key made for one website. There’s nothing to type, and nothing a lookalike site can use. Vautir keeps your passkeys in your vault, so they sync to all your devices.

Create a passkey

When a website offers to create a passkey, Vautir asks: Save a passkey for the website. Choose Save passkey.

The passkey joins the login you already have for that site and account. If there’s none, it gets a login of its own.

Sign in with a passkey

• When a site asks for a passkey, Vautir shows Sign in to the website, with the passkeys it holds for it. Choose Sign in.
• On sites that offer passkeys in the sign-in field, click the field: the menu lists your passkeys, marked Passkey, above your logins. Pick one.

Every prompt also has Not now, and Use another device, which hands the request to your browser: a security key, a phone, or the computer’s own passkeys.

While Vautir is locked

The prompt shows Unlock, which opens the popup. Vautir never asks for your master password inside a web page, where a page could imitate the prompt.

On your phone

• iPhone and iPad: the system’s own sheet asks, and Vautir confirms with Face ID or Touch ID before it makes or signs anything.
• Android 14 and later: Vautir’s passkeys show in Android’s sign-in sheet, in browsers and in apps.

Seeing and removing a passkey

A login with a passkey is marked Passkey. Open it to see Signs in to and the website, with Remove.

Removing a passkey in Vautir doesn’t tell the website: remove it in your account there too.

Moving passkeys

Export a Credential Exchange file to take your passkeys, private keys included, to another app that reads the format, and import one to bring them in. See Exporting your vault.

Vautir or your browser

Passkeys, under Account in the browser extension, says who answers websites’ passkey requests in this browser: Vautir, as it does from the start, or The browser, which offers its own passkeys, a phone or a security key. Your passkeys saved in Vautir stay either way.

Websites that encrypt with a passkey

Some websites use a passkey to unlock encrypted data too, through WebAuthn’s prf and largeBlob extensions. Vautir answers both, and the secrets behind them sync with the passkey, so a passkey gives the same values on every device.

One website, several domains

A website can let its other domains use its passkeys, by listing them at its own address. The browser extension reads that list itself, never from the page, which is why it asks your browser for access to every https site. In Safari, a list Vautir can’t reach leaves the request to Safari.

What isn’t supported

• A website that asks for a security key or a phone goes to the browser.