You can now unlock your vault with a passkey

Neuron5569 · February 6, 2026, 1:33am

Not answering the question (not knowing all the possible conditionals that would get you there), but I note that in this client’s code:

github.com/bitwarden/clients

libs/key-management-ui/src/lock/services/default-webauthn-prf-unlock.service.ts

831bde21f


      
                // The credential ID is already base64url encoded from login storage
                // We need to decode it to ArrayBuffer for WebAuthn
                const decodedId = Fido2Utils.stringToBuffer(credentialId);
                return {
                  type: "public-key",
                  id: decodedId,
                  transports: (transports || []) as AuthenticatorTransport[],
                };
              }),
              rpId,
              userVerification: "preferred", // Allow platform authenticators to work properly
              extensions: {
                prf: { eval: { first: prfSalt } },
              } as any,
            },
          };
          
          const response = await this.navigatorCredentials.get(options);
          
          if (!response) {
            throw new Error("WebAuthn get() returned null/undefined");

the userVerification is hardcoded to be “preferred”; as this code seems to be used for unlock, there’s a good chance what you think is good might be true, or at least some of the time.