Passkeys, explained

A passkey is a key your own device makes and keeps. There is nothing to invent, remember or type, and nothing to reuse across sites. Your device proves it holds the key by asking you to unlock it: your fingerprint, your face, or the PIN or password you already use on that device.

We never see it. It can't be guessed, it can't leak in someone else's data breach, and a convincing-looking email can't trick you out of it, because a passkey only works on the site it was made for.

1. A panel slides up on your phone, or a small box appears on your computer. That prompt comes from your device, not from us, which is why it looks different from the rest of the page.
2. It asks for your fingerprint, your face or your screen lock. It may also ask where to save the passkey: your phone, your password manager, or a security key.
3. That's it. Answering the prompt creates the passkey and you carry on. Nothing is emailed to you and there is no code to type.

If you close the prompt by accident, nothing is lost. Press the button again.

Use a device only you unlock. Anyone who can unlock this device with their own face or fingerprint can open your family's space from it, because a passkey trusts the device and whoever the device accepts.

On a shared family computer, or a phone your children also unlock, set Vault For Us up on your own device instead. Everyone in the family gets their own invite and their own passkey.

Choose use a phone or tablet when your browser asks. You scan a code with your phone and the passkey is made there. Your phone holds it, and this computer never sees it. A hardware security key works too.

Passwords, the part that holds bank and website logins, can only be opened by your passkey itself, so that not even we can open it. That needs a newer passkey feature that a few older devices, browsers and password managers don't offer.

If yours doesn't, everything else works normally on that device: documents, photos, reminders, the calendar. Only Passwords stays shut, and it tells you so plainly.

What works: an iPhone or iPad saving the passkey to iCloud Keychain, an Android phone saving it to Google Password Manager, most current desktop browsers, and most newer hardware security keys. The feature is called PRF, if you ever want to check a security key's spec sheet.

What to do: add a phone as a second device from You → Security → Devices, and open Passwords there. If the device you are on is the only one you will ever use, Passwords won't be usable, which is worth knowing before you pay for a plan.

Some password managers refuse to make a second Vault For Us passkey while an old one is saved, usually one left over from a setup that stopped halfway. Delete the old entry (Passwords in your iPhone or Android settings, or your password manager's own list) and try again.

Sign in on another device you have already added, open You → Security → Devices, and remove the lost one. Its passkey stops working straight away.

If every device is gone, your paper Recovery Kit is the way back. That is the code you copied out by hand when you signed up, and this guide walks through how it works.