A passkey replaces a site's password with a key that lives on your device and is unlocked by your face, your fingerprint or your Master PIN. There is nothing to remember, nothing to type, and nothing for a fake login page to steal. DroidPass now stores passkeys next to your passwords and syncs them to your other devices.
Why a passkey is harder to steal than a password
A password is a shared secret: you know it and the site knows it, so anyone who tricks you into typing it somewhere else has it too. A passkey is a key pair. The site keeps the public half, your device keeps the private half, and the private half never leaves. A convincing copy of your bank's login page gets nothing, because there is nothing to hand over.
Creating your first passkey
- Turn DroidPass on as a provider: Settings → General → AutoFill & Passwords, then enable DroidPass.
- On a site that offers passkeys, choose to create one — it is often under security or sign-in settings.
- Confirm with Face ID, Touch ID or your Master PIN. DroidPass files the passkey into your vault.
Next time you sign in, pick your account and confirm. No password, no code, no waiting for an SMS.
Where passkeys sync — and what a new device needs
Passkeys sync through your DroidPass account like the rest of your vault, encrypted before they leave the phone. When you set up a new device, it needs your Secret Key as well as your Master PIN before it can open them. That is deliberate: it means your passkeys cannot be unlocked by someone who only learned your PIN. Your Emergency Kit has the Secret Key — print it before you need it.
Passkeys do not replace every password yet
They only work where a website or app has implemented them, and most of the internet has not. Treat passkeys as something you turn on site by site as it becomes available, while DroidPass keeps the passwords for everywhere else — along with 2FA codes for the accounts that still use them.
Bringing passkeys over from another app
If you are switching, passkeys can come across with your logins — see how to transfer from another app. One caveat worth knowing: a transferred passkey occasionally arrives looking correct and is still refused by the site, because of how the other app exported it. If that happens, delete it and create a fresh passkey on the site. It takes seconds.
The free plan keeps one
You can hold one passkey on the free plan, which is enough to try it on your most important account. Pro removes the limit, along with the six-item cap on the rest of your vault.