Unlock with FIDO2/“passkeys”

[Be.ing (Be)]

@grb

there are technical constraints that prevent this

Could you elaborate? I was under the impression that it simply hasn’t been implemented yet, not that it’s impossible. It would be awfully disappointing if it isn’t possible. Is this related to why the browser extension opens a browser tab to prompt for WebAuthn when using WebAuthn as a second factor?

[grb]

@Be.ing

Could you elaborate?

I was referring to this:

"Login with passkeys" - what does beta mean?

Are there any (current) plans expand passkey login to the browser extensions for Chromium browsers? Seems like the technical prerequisites should already be in place to allow that to happen. At the moment, we’re blocked by the fact that browser extensions use a different url than the one used to register the passkey (eg. vault.bitwarden.com) and so we are blocked on bringing this to the browser extension until additional support for this scenario is accepted into the webauthn spec and develop…

 

Nonetheless, apparently, some of the technical roadblocks were removed a few months ago, so there progress on implementation of passkey login for the browser extensions may be coming in 2025:

"Login with passkeys" - what does beta mean?

There is! Very recently, Safari has added support for the PRF extension. While it isn’t working perfectly for hardware keys, it’s now possible to save a passkey in Apple’s built in password manager and use it to log into the web vault passwordlessly on macOS/Safari. Also recently, the needed PRF extension for related origins was merged. This was the blocker for bringing “login with passkey” to the browser extension. Bitwarden will provide more details when work is in progress, but be on the l…

[zmberber (Berber)]

another one of those +1 posts “just writing a comment to support the addition of this feature”.

this feature would allow more convenience to having the vault to have a very short lock time.

is this hard to inplement? i would like to understand the reluctance to add such a feature.

[shiveenp (Shiveen Pandita)]

Chiming in to say that I would very much like this feature. And 1Password is also currently trialling this in their beta >> Unlock 1Password with a passkey (beta) | 1Password Support

[Nail1684]

Note: The title of this Feature Request (FR) was updated from Unlock Bitwarden with 2FA, e.g. security key / YubiKey (instead of, not in addition to password) to Unlock with FIDO2/“passkeys”.
 
Further info / explanations to that:

This FR proposes the use of FIDO2/“passkeys” (this includes hardware security keys, e.g. YubiKeys) as a new option for unlocking a locked vault – i.e., an alternative to the current unlocking methods (unlocking with master password, PIN, or biometrics).

Though “2FA” was previously mentioned in the title of this FR, to date, the majority of posts in the thread have proposed the use of YubiKeys or similar hardware security keys for unlocking the vault. Furthermore, in the time since this feature request was opened, it has become possible to store FIDO2 credentials not only on hardware security keys but also in TPMs (Trusted Platform Modules), mobile phones, and in “(software) authenticators” (e.g., in the form of syncable passkeys). The scope of the feature request has therefore been broadened to include vault unlocking using any form of “FIDO2” (hardware security keys, passkeys, etc.).

[Gatsu]

I’d like to add that talking with my buddy who is a lawyer he has pointed out to me that at least in the United States biometrics such as a fingerprint can be something you’re compelled to provide by police if they have a warrant or while in custody. While something you “know” such as a FIDO2 passkey and an associated PIN unlocking the FIDO2 authenticator is protected under both the 4th and 5th amendments and you wouldn’t be compelled to provide access to law enforcement under the law.

I know someone could use the old “wrench authentication method” xkcd: Security to unlock your vault but a simple FIDO2 based PIN + FIDO2 device provide significantly more legal and real-world protection than a biometric read on a phone or a short say 4 digit pin that could be brute forced extremely quickly.

I’m not advocating for anyone to break the law but privacy is important. I know the masterpassword is required to decrypt the vault but at least android phones already offer the ability to use your biometrics to unlock the vault which many users may not understand leaves them vulnerable to losing all their passwords if they are asleep, or say sleeping off an innocent night of partying in the police station.

[Nail1684]

I just had a casual look into GitHub… and (but probably very early!) there is some interesting news – at least for the web vault and the browser extensions for now:

PM-2035: PRF Unlock (web + extension)

 

Dependent on (server) PR:

PM-2035: PRF Unlock

[dabura667]

Glad to see PRF unlock coming down the pipeline.

PRF login for extension works well, but I need to keep the local cache active for when I go offline and access internal LAN sites while not connected to the internet.

[sclark]

So I love that login with passkey was added to some Browser extensions in 2025.11.0! But why is there not an option to unlock the browser extension with a passkey?

I’d consider just logging out every time, but I can’t tell what settings get deleted on logout, and which ones stay.

I did minimal testing, and saw that the Account Security > “Unlock with PIN” option was removed (unchecked) after logout and login with passkey. However a change to Autofill >“Copy TOTP Automatically” persisted after logout and login with passkey. Is there any documentation on what settings persist or clear upon logout?

Would it be better to add an option to unlock with passkey or just set the vault to logout every time?

[grb]

@sclark I have moved your comment into the relevant feature request thread.