A new device usually needs your master password and your Secret Key, typed. With a device that’s already logged in at hand, it needs neither: that device hands the new one what it needs, sealed so only the new device can open it.
How
- On the new device, choose Use a device that’s logged in, and enter your account’s email address. Vallkey emails you a code.
- Type the emailed code on the new device. It then shows a request code: four groups of five digits.
- A device that’s logged in asks: A new device asks to be let in. Type the request code there, and choose Let it in. Or choose Refuse, if it wasn’t you.
- The new device opens your vault. From then on, your master password unlocks it, or your face or fingerprint.
Every app can ask, and every app can answer.
Why the code
The request code comes from a key the new device made for this request. Your logged-in device hands over your keys only if the code you typed matches the key it was sent. So nobody in between, our server included, can slip in a key of their own.
The emailed code keeps strangers out: nobody is shown a request from someone who only knows your address.
If you’ve lost every device
- Use your recovery code, or codes from two trusted contacts.
- In a family, the organizer can help, if you turned family recovery on.
- In an organization that allows it, an admin can let your new device in. You read the request code out to them, on a call, and they type it in the console.
What to know
- Whoever holds one of your unlocked devices, and reads your email, can let a device of their own in. That’s as much as they could do with the device itself.
- If your organization uses single sign-on, the new device still signs in with your identity provider first.
Last updated October 4, 2026