Passwords are the weakest link in any authentication system. Phishing pages, credential stuffing, password reuse, and keyloggers all rely on the password being something a human knows and types. Passkeys remove the password from the picture.

Today we're rolling out passkey sign-in for the dashboard. From your Settings page, you can register a passkey on every device you sign in from: FaceID and TouchID on Apple devices, Windows Hello on PCs, hardware security keys (YubiKey, Titan), and any other FIDO2 authenticator your browser supports.

How it works

Once you've registered at least one passkey, the sign-in page offers Sign in with passkey as an alternative to typing your password. The browser challenges your authenticator, you approve with biometrics or a tap, and the dashboard signs you in.

Behind the scenes, every passkey assertion is verified against a credential public key stored in your account, with a per-credential signature counter that detects cloning attempts. The private key never leaves your authenticator. SikkerKey never sees it.

Passkeys are phishing-resistant by construction. The browser binds the credential to the origin where it was registered, so a fake sikkerkey.com domain (no matter how convincing) can't trick the authenticator into signing for the real one.

Passwordless mode

Customers using passkeys plus an OAuth provider (GitHub or Google) can opt out of passwords entirely. Toggle passwordless mode in Settings and your password is removed. Sign-in then goes through your passkey or your OAuth provider.

At first passkey enrollment we generate eight single-use recovery codes, hashed at rest with Argon2id. Save them somewhere safe. If you lose your authenticator and your OAuth provider is unreachable, recovery codes are how you regain access to your vault.

What it covers

Sign-in to the dashboard at app.sikkerkey.com
Step-up authentication for destructive actions: revoke a session, change your password, delete your vault
Passwordless mode for accounts that pair a passkey with an OAuth identity
Counter-anomaly detection that flags potential clone attempts in your audit log

What it doesn't cover

Machine authentication still uses Ed25519 keypairs and is unchanged. Passkeys are designed for human-in-the-browser flows; machine-to-API authentication has its own protocol (HTTP signatures with strict replay protection) that isn't going anywhere.

Try it

Head to Settings → Security and click Add a passkey.