Passkeys
Passkeys are WebAuthn-based credentials that replace passwords: they use a cryptographic key pair instead of a shared secret, and can sync across devices.
A passkey is a sign-in credential based on the WebAuthn standard. Instead of memorizing and typing a password, the user authenticates by unlocking their device (biometrics or PIN), which in turn authorizes the use of a private key stored securely on the device or synced through a provider (for example, the operating system's password manager).
Because authentication relies on public-key cryptography rather than a shared secret, passkeys are resistant to phishing: there's no password a fake site can capture and reuse. There are also no 'password' databases that can leak, because the server only stores a public key, which is useless without the matching private key.
Passkeys are designed as a direct replacement for passwords, not as an additional second factor: the standard's ultimate goal is to reduce, and ideally eliminate, the need for traditional passwords.
As of today, V4ult does not offer sign-in via passkeys. Its biometric authentication (Face ID, Touch ID, Android biometrics) is used to locally unlock a session already started with the user's master password, not to replace sign-in against the server.
Advantages
- Resistant to phishing
- No need to remember or type passwords
- Leave no reusable secret that could leak in a database breach
Related
Frequently asked questions
What are passkeys?
They are sign-in credentials based on the WebAuthn standard that replace passwords, using a cryptographic key pair instead of a shared secret.
Are passkeys more secure than passwords?
Against phishing and database breaches, yes: there's no shared secret an attacker can steal or reuse, because the private key never leaves the user's device.
Can I sign in to V4ult with a passkey?
No, not currently. V4ult uses a master password with local biometric unlock, but does not offer sign-in via passkeys or WebAuthn.