What a passkey is
A passkey is a pair of keys created by your device when you add it. The private key stays in your password manager or on your device and is unlocked by your fingerprint, face or PIN. Pluggie stores only the public key, which cannot be used to sign in.
- Nothing to steal from us. There is no password or shared secret on our side that would let anyone sign in as you.
- Phishing-resistant. A passkey is bound to
my.pluggie.net. A fake sign-in page on any other address cannot use it, however convincing it looks. - Nothing to remember or type. No password to reuse, no six-digit code to copy before it expires.
What you can do with it
- Sign in in one step. Pick your account in the sign-in form, or click Sign in with a passkey. No password and no 2FA code.
- Use it instead of the 2FA code. Signed in with your password? The passkey can stand in for the authenticator code.
- Confirm sensitive actions. Wherever Pluggie asks for a 2FA code — deleting a tunnel, turning off client certificates remotely, creating new recovery codes, turning off 2FA or deleting your account — you can confirm with your passkey instead.
Where your passkey is stored
In the same place as your passwords: iCloud Keychain, Google Password Manager, 1Password, Bitwarden, Strongbox and other password managers, or a hardware security key. Most of them sync passkeys to your other devices, so one passkey added on your phone also works on your laptop. You can add up to 10 passkeys, for example one per password manager or security key.
How to add a passkey
Sign in to your Pluggie account and click Add a passkey.
Enter your password (and your 2FA code if 2FA is on), or confirm with a passkey you already have.
Your browser or password manager asks where to save the passkey. That's it — next time, sign in with it.
After you sign in with your password, a password manager that supports it may offer to create a passkey for you automatically. Accept, and you are done.
Staying in control
- Every change is recorded. Adding or removing a passkey asks you to confirm it's you, appears in Security activity in your settings, and we email you about it if your account has a verified email address.
- Lost the device? Sign in with your password and 2FA code, or with a recovery code, and remove the old passkey in Settings → Passkeys.
- Removing a passkey. Where the browser supports it, Pluggie also tells your password manager that the passkey is gone, so it does not keep offering it.
Passkeys are one more way into your account. You can keep using your password and 2FA, use both, or switch between them on different devices.
If adding or using a passkey does not work on your device, write to support@pluggie.net with the browser and password manager you use.