Passkeys and security keys

What passkeys are

A passkey replaces your password with your device's screen lock, fingerprint or face, or with a security key. It is made for hrva.cc only, so it can't be phished. A passkey can live on your phone or computer, in a password manager, or on a hardware key.

Add a passkey or security key

1. Sign in and open Dashboard → Settings.
2. Under Passkeys and security keys, select Add a passkey or security key.
3. Enter a Name, for example MacBook, iPhone or YubiKey. If you leave it empty, it's called Passkey. If you sign in with a password, also enter your Current password. If you sign in with Google or GitHub and your last sign-in was more than 15 minutes ago, you'll be asked to sign in again first. Select Continue. It reads Waiting for your passkey… while the prompt is open.
4. Choose where to save it in the prompt that opens. The four places are below.

On this phone or computer

This covers iCloud Keychain, Google Password Manager and Windows Hello.

1. Choose this phone or computer in the prompt.
2. Confirm with your fingerprint, face or device PIN.

In a password manager

This covers password managers such as Bitwarden, Proton Pass and 1Password.

1. The password manager's extension shows its own prompt. Choose to save the passkey there.
2. If the browser's prompt opens instead, pick the password manager, or the "another device" option.

On your phone, from a computer

1. Choose the phone or QR code option.
2. Scan the code with your phone's camera.
3. Confirm on the phone.

On a security key (YubiKey)

1. Plug the key into USB or Lightning, or hold it to your phone for NFC.
2. Enter the key's PIN if asked.
3. Touch the key.

An older key, or one whose passkey storage is full, is added as Security key (second step only). It works after your password, but it can't sign you in on its own.

5. You'll get an email, "A passkey was added to your account". If you didn't add it, remove it in Settings, then change your password, or secure your Google or GitHub account if you sign in with one.

What the labels in Settings mean

• Synced passkey: works on your devices that share this password manager or account.
• Device-bound passkey: only on this device or key.
• Security key (second step only): use it after your password; it can't sign you in alone.
• Passkey or security key: try Sign in with a passkey. If it isn't offered, use it after your password.

Sign in with a passkey

1. On the sign-in page, select Sign in with a passkey, or select the Email field and pick your passkey from the suggestions.
2. Confirm on your device, or touch your security key.

A passkey sign-in counts as two-step verification on its own, so no second step follows. A Security key (second step only) can't be used here: sign in with your password, then use the key at the second step.

Two-step verification with passkeys

1. Add at least one passkey or security key.
2. In Settings → Two-step verification, select Turn on with my passkeys.
3. Save the 10 recovery codes: select Copy codes or Download (.txt) and keep them somewhere safe, such as your password manager. Tick I've saved these codes, then select I've saved them.

Settings then shows Your second step: how many passkeys or security keys you have, and whether an authenticator app is set up. You can add an authenticator app as well with Set up an authenticator app. If two-step verification is off, setting one up also turns it on.

From then on, after your password, Google or GitHub sign-in, the Two-step verification screen asks for one of these:

• Use a passkey or security key. It reads Waiting for your passkey… while the prompt is open.
• Under or enter a code, a code from your authenticator app or a recovery code, then Verify & sign in.

Use a different account takes you back to the sign-in form with your email filled in. After a Google or GitHub sign-in, Back to sign in returns to the sign-in page. Lost your passkey or codes? opens this guide at If you lose a device or security key in a new tab.

Recovery codes

You see the 10 recovery codes once, when you turn two-step verification on. Copy codes copies all of them, and Download (.txt) saves them as hrva-cc-recovery-codes.txt. Keep them outside hrva.cc, for example in your password manager or on paper.

Each recovery code works once, in the Authenticator code or Recovery code field of the second step. Upper or lower case, spaces and the dash don't matter.

Settings shows how many are left. With 2 or fewer it says Running low on recovery codes, and with none No recovery codes left. To get 10 new ones, turn two-step verification off and on again. Turning it off deletes the old ones.

If you lose a device or security key

1. Sign in with another passkey, your authenticator app or a recovery code.
2. In Settings → Passkeys and security keys, select Remove next to the lost one. If you sign in with Google or GitHub and your last sign-in was more than 15 minutes ago, you'll be asked to sign in again first. If it's your only two-step method, turn off two-step verification first, or add another passkey, security key or authenticator app.
3. Turning two-step verification off needs one of those as well.

If you have none of them, email privacy@hrvalabs.net from your account's address. Removing a passkey on hrva.cc doesn't delete it from your device or password manager, so delete it there too.

Passkeys and your privacy

hrva.cc stores the passkey's public key and a few details, such as its name, when it was added and last used, and whether it's synced. Your fingerprint, face and PIN never leave your device. The Privacy Policy describes everything hrva.cc stores.