Overview

A passkey is a passwordless, phishing-resistant way to sign in to Truestamp. Instead of typing a password, you approve a prompt on your device with Touch ID, Face ID, Windows Hello, a device PIN, or a hardware security key, and that approval is a complete sign-in on its own: no password and no two-factor code. You add passkeys from your profile after your account exists, you can keep several (one per device is typical), and you can rename or remove them at any time without any risk of locking yourself out, because password and magic-link sign-in (see signing in to Truestamp) always remain available.

What a passkey is

A passkey is a cryptographic key pair created by your device, built on the WebAuthn web standard. The private half never leaves your device (or your platform’s password manager, if it syncs passkeys across your devices); Truestamp stores only the public half, together with the name you gave the passkey and bookkeeping such as when it was added and last used. Signing in means proving to Truestamp that your device holds the private key, which is why there is no password to type, reuse, or leak.

Passkeys are phishing-resistant by construction: a passkey is bound to the Truestamp domain it was created for, and your browser will only offer it on that genuine domain. A look-alike site cannot trigger your Truestamp passkey, which is a stronger guarantee than any amount of care with a password.

Adding a passkey

You add passkeys from the security section of your profile, while signed in:

1. Choose “Add a passkey”.
2. Name it first, with a name you will recognize later, such as “MacBook Touch ID” or “YubiKey” (up to 60 characters; if you leave it blank it is saved as “Passkey”).
3. Create the passkey when your browser prompts you: confirm with Touch ID, Face ID, Windows Hello, your device PIN, or by touching your security key.

If you cancel the browser prompt or it fails, nothing is saved and you can simply try again. There is no limit tied to a single device: you can add a passkey on each device you sign in from, and each appears as its own named entry in the list.

You cannot create a Truestamp account with a passkey. Accounts are established with email and password or with a magic link (see the life of a Truestamp account); a passkey is something you add to an existing account to upgrade how you sign in.

Signing in with a passkey

The sign-in page offers a “Sign in with Passkey” button alongside the password and magic-link options. You do not type your email first: your browser or password manager shows the passkeys it holds for Truestamp, you pick one, and you approve it on your device. That single approval completes the sign-in and establishes your session.

A passkey sign-in is deliberately one step. Even if you have two-factor authentication enabled, you are not asked for an authenticator-app code after a passkey sign-in. Approving a passkey always takes a verifying gesture (a fingerprint, face, or device PIN), not just a tap, so a single approval combines something you have (the device holding the key) with something you are or know (the biometric or PIN). Because that already amounts to two factors, the sign-in is treated as having satisfied the second factor for that session. Each successful passkey sign-in also updates the “last used” time shown next to that passkey in your profile.

If your browser or device does not support passkeys, the sign-in page tells you so, and you sign in with your password or a magic link instead.

Managing your passkeys

Your profile lists every passkey on your account with its name, the date it was added, and when it was last used (a passkey you have never signed in with shows “Never used”). From that list you can:

• Rename a passkey at any time, for example after replacing a device.
• Remove a passkey, after a confirmation. A removed passkey can no longer sign in to your account.

Removing passkeys can never lock you out. Password and magic-link sign-in remain available regardless, so Truestamp allows you to remove every passkey, including the last one. If you lose a device that held a passkey, sign in with your password or a magic link and remove that passkey from your profile.

Passkey activity is recorded in your account’s security activity: signing in with a passkey, adding one, and removing one all appear there, so you can review them later.

Passkeys and two-factor authentication

Passkeys and TOTP two-factor authentication solve overlapping problems in different ways, and they coexist on one account:

• Two-factor authentication is a second step layered on top of password and magic-link sign-ins. It keeps protecting those sign-ins whether or not you have passkeys.
• A passkey is a primary credential that replaces the password step entirely, and it skips the two-factor prompt because a passkey approval already combines device possession with a verifying gesture (a biometric or device PIN), the two factors a separate code would otherwise add.

In practice this means you can enable both: passkeys for the devices you use regularly, with TOTP still guarding the password and magic-link paths you fall back on. See two-factor authentication for how the TOTP second factor and recovery codes work.

Limitations

• A passkey cannot register a new account; it only signs in to an account that already exists.
• Passkeys cover interactive browser sign-in only. Programmatic access for scripts and applications uses API keys or OAuth, which are separate credentials.
• A passkey lives on the device or security key that created it (or in your platform’s password manager, if it syncs passkeys). Losing that device means losing that passkey, which is why password and magic-link sign-in always remain as fallbacks and why keeping a passkey on more than one device is sensible.
• Passkey support depends on your browser and device. When passkeys are unavailable, every other sign-in method still works.

Citations

1. W3C Web Authentication (WebAuthn) Level 2. The web standard passkeys are built on: public-key credentials scoped to a web origin, which is the basis for the phishing-resistance claims in this concept.