A passkey replaces a password with a key made for one website. There’s nothing to type, and nothing a lookalike site can use. Vallkey keeps your passkeys in your vault, so they sync to all your devices.
Create a passkey
When a website offers to create a passkey, Vallkey asks: Save a passkey for the website. Choose Save passkey.
The passkey joins the login you already have for that site and account. If there’s none, it gets a login of its own.
Sign in with a passkey
- When a site asks for a passkey, Vallkey shows Sign in to the website, with the passkeys it holds for it. Choose Sign in.
- On sites that offer passkeys in the sign-in field, click the field: the menu lists your passkeys, marked Passkey, above your logins. Pick one.
Every prompt also has Not now, and Use another device, which hands the request to your browser: a security key, a phone, or the computer’s own passkeys.
While Vallkey is locked
The prompt shows Unlock, which opens the popup. Vallkey never asks for your master password inside a web page, where a page could imitate the prompt.
On your phone
- iPhone and iPad: the system’s own sheet asks, and Vallkey confirms with Face ID or Touch ID before it makes or signs anything.
- Android 14 and later: Vallkey’s passkeys show in Android’s sign-in sheet, in browsers and in apps.
Seeing and removing a passkey
A login with a passkey is marked Passkey. Open it to see Signs in to and the website, with Remove.
Removing a passkey in Vallkey doesn’t tell the website: remove it in your account there too.
Moving passkeys
Export a Credential Exchange file to take your passkeys, private keys included, to another app that reads the format, and import one to bring them in. See Exporting your vault.
Vallkey or your browser
Passkeys, under Account in the browser extension, says who answers websites’ passkey requests in this browser: Vallkey, as it does from the start, or The browser, which offers its own passkeys, a phone or a security key. Your passkeys saved in Vallkey stay either way.
Websites that encrypt with a passkey
Some websites use a passkey to unlock encrypted data too, through WebAuthn’s prf and largeBlob extensions. Vallkey answers both, and the secrets behind them sync with the passkey, so a passkey gives the same values on every device.
One website, several domains
A website can let its other domains use its passkeys, by listing them at its own address. The browser extension reads that list itself, never from the page, which is why it asks your browser for access to every https site. In Safari, a list Vallkey can’t reach leaves the request to Safari.
What isn’t supported
- A website that asks for a security key or a phone goes to the browser.
Last updated October 3, 2026