The popular password manager Bitwarden recently announced a major new capability – support for passkeys within its browser extension. This integration ushers passwordless authentication into the mainstream for Bitwarden’s millions of users.
In this guide, we’ll cover everything you need to know about passkeys, how exactly Bitwarden implements passkey support, the security and convenience benefits this brings, and how to start using passkeys with your Bitwarden vault for enhanced account protection.
What are Passkeys and How Do They Work?
Passkeys represent a new way of logging into online accounts without traditional passwords. Instead, passkeys utilize public key cryptography to confirm your identity. Here’s a quick rundown:
- Passkeys use public/private key pairs generated on the user’s device. The private key stays on your device.
- The public key gets registered with the online service and linked to your account.
- Logging in involves proving ownership of the linked private key. This confirms your identity.
- You prove ownership through secure mechanisms like biometrics or PINs rather than typing a password.
This advanced cryptographic approach powered by public key infrastructure makes passkeys far more secure than vulnerable plain text passwords.
Why Passkeys Represent the Future of Login Security
Passkeys introduce major security and convenience improvements over old-fashioned password authentication:
- No more password breaches – Passkeys live only on your device, so there are no passwords for hackers to steal.
- Enhanced phishing protection – Website spoofing is ineffective without your passkey stored anywhere in the cloud.
- No password reuse concerns – Unique passkeys inherently prevent reused credentials spreading across accounts.
- Major convenience – Passkeys eliminate having to manually enter or manage passwords yourself.
- Biometric unlock – Fingerprint or face recognition provides easy instant authentication.
- Platform integration – Passkeys integrate natively across Apple, Google, Microsoft and web ecosystems.
Passkey adoption is still early, but activity from platforms like Apple, Google, Microsoft and Mozilla signal this is the future of account security everyone can rely on.
How Bitwarden Leverages WebAuthn for Secure Passkey Support
Bitwarden relied on the new WebAuthn open standard to extend passkey support to its users. WebAuthn handles the underlying public/private key cryptography in the browser for passkey generation and authentication.
When users opt to create a passkey within Bitwarden, the browser extension calls the WebAuthn API which:
- Securely generates on-device asymmetric public and private key pairs for the account.
- Transmits and registers the public key with the target online service, associating it with the user’s account.
- Enables the user subsequently proving ownership of the private key securely via biometrics or other local factors, in order to authenticate and login.
This integration allows Bitwarden to leverage WebAuthn for robust public key-based passwordless logins while still making the experience friendly for mainstream users.
Step-by-Step Guide to Using Passkeys with Bitwarden
Ready to upgrade your account security with passkeys? Here is how simple getting started is for Bitwarden users:
- Install the Bitwarden browser extension if you haven’t already.
- When registering a new account on a supporting website, check for a “Sign up with Passkey” option.
- Choose to sign up with your Bitwarden account. The site will call Bitwarden via WebAuthn.
- Authenticate locally on your device via fingerprint/Windows Hello/PIN to generate your key pair through Bitwarden.
- That’s it! Subsequent logins authenticate against your on-device keys.
The process feels identical to traditional password management, abstracting the complex cryptography powering passkeys seamlessly under the hood.
Over time, passkey support will expand across more of your existing accounts beyond just new registrations as adoption spreads. But you can start benefitting from passkeys now by enabling them anytime you create new online accounts going forward.
How Passkeys Improve Upon FIDO Security Keys
You may be wondering how passkeys compare and contrast with existing FIDO-compliant hardware security keys from companies like Yubico which also provide passwordless two-factor authentication (2FA).
While hardware security keys serve an invaluable role enhancing account security, passkeys offer some advantages:
- Built-in – No need for separate external devices. Passkeys are generated automatically on the platform and device itself.
- Ease of use – No inserting and configuring a separate key. The passkey experience feels like standard password authentication.
- No cost – Users avoid the extra cost of purchasing hardware keys. Passkeys are free and universal.
- Native integration – Platforms like iOS and Android already have native passkey frameworks ready for biometric login.
- Automatic sync – Passkeys inherently sync automatically across devices logged into the same account, avoiding manual transfer steps required for hardware keys.
Hardware security keys will remain useful for many applications. But passkeys make passwordless security available to the mass mainstream thanks to intelligent software integration directly into devices and browsers people already use.
Early Adoption: Which Sites Support Passkeys Currently?
As an emerging standard, passkey adoption remains at an early stage but is quickly gaining momentum, especially thanks to backing from Apple, Google and Microsoft.
Some major platforms and sites that currently support passkey use include:
- Apple (Apple ID)
- Google (Google Accounts)
- Microsoft (Microsoft Accounts)
- Mozilla (Firefox Accounts)
- GitHub
- Stripe
- Okta
- LastPass
- 1Password
More online services will steadily add passkey support over the next year, accelerating the passwordless transformation. But you can already enjoy enhanced security today on key sites.
Storing Passkeys in Your Bitwarden Vault
Once passkeys are generated through WebAuthn, Bitwarden automatically saves these passwordless credentials within your Bitwarden vault for easy centralized access and management.
Within your vault, passkeys display like any other login but are tagged with a “Passkey” label to differentiate the new credential type prominently.
All passkeys are securely encrypted using your Bitwarden master password and session key. Even Bitwarden never sees the raw passkey data, aligning with its zero-knowledge model.
Storing passkeys within Bitwarden allows enjoying consolidated credential access alongside traditional saved website logins as you progressively upgrade accounts to passkeys over time.
Sharing Passkey Access Among Bitwarden Users
A useful feature Bitwarden supports is sharing passkey access across Bitwarden users, such as between family members or teams.
However, passkeys can only be shared with others who can authenticate against the original device where the passkey was first created. This maintains security by only granting access to everyone who owns the private key.
For example, you can create a passkey on your own device and then also install Bitwarden on your family member’s device. Once logged into a shared Bitwarden vault, they can use biometric unlock on their own device to authenticate the shared passkey.
Through this collaborative yet controlled sharing model, Bitwarden expands passkey convenience without compromising security safeguards.
Convenience of Auto-Filling Passkeys on Websites
Another way Bitwarden streamlines passkey usage is allowing fast auto-fill of passkeys into websites and apps that prompt for authentication.
When logging into a website where you previously registered a passkey, Bitwarden automatically selects the appropriate passkey and injects it via WebAuthn when you initiate auto-fill. This saves tapping through screens manually searching for the right passkey.
For added protection, accessing auto-filled passkeys still requires explicitly unlocking your Bitwarden vault first by entering your master password or scanning a biometric factor like fingerprint or face ID depending on your settings.
Limitations and Challenges in Early Passkey Adoption
While passkeys represent a major leap for passwordless login technology, some limitations still exist in these early days:
- Not universally supported – Enablement across the web remains gradual as platforms and sites slowly add passkey functionality.
- Users require education – Explaining the paradigm shift of passkeys from traditional passwords poses user experience challenges.
- No recovery options yet – Mechanisms to securely recover lost passkeys are still in development across the industry.
- Standards still emerging – Universal protocols for passkey syncing across browsers and platforms will continue to be refined.
However, pioneering platforms like Apple, Google, and Microsoft are actively driving adoption and collaborating to smooth out limitations. Support from password managers like Bitwarden also helps bring passkeys into the mainstream.
The Future is Passwordless With Passkeys
Passkeys mark an historic turning point heralding the definitive end of cumbersome password-based authentication as we know it. And Bitwarden is helping spearhead that passwordless future for its users via seamless integration.
But for all their potential, passkeys remain just one piece of comprehensive identity security. Using a robust authenticator app for second factors and security keys for sensitive accounts is recommended.
With expertise strengthening password practices these past 16 years, Bitwarden is poised to guide users into the passwordless age while keeping identity protection a priority.
Soon, the next generation may grow up scarcely aware of passwords at all. But for those who grew up battling poor password hygiene for decades, passkeys feel like a hard-won security victory well worth celebrating.
Frequently Asked Questions About Bitwarden Passkeys
Here are answers to some common questions users have about passkeys in Bitwarden:
Are passkeys as secure as hardware security keys?
Passkeys offer similar cryptographic security benefits as hardware keys but without requiring a separate physical device.
What happens if I lose or replace my device?
As long as your Bitwarden vault is backed up, you can restore passkeys to a new device and regain access.
Can I reuse passkeys across multiple sites?
No, unique passkeys should be generated per site or service to avoid credential stuffing attacks if one passkey is compromised.
Do passkeys require biometrics to authenticate?
Biometrics like fingerprint or face ID are recommended for enhanced security, but you can also set up passkey-protected accounts using a simple PIN.
How can I tell if a site supports passkeys?
Look for a “Sign in with passkey” option during account creation. Currently, this capability must be explicitly enabled on a per-site basis.
What web browsers are compatible?
Passkeys currently work across all major desktop and mobile browsers like Chrome, Firefox, Safari, Edge, and Opera.
With Bitwarden accelerating user familiarity with passkeys, the passwordless future looks brighter. Soon usernames and passwords may fade into distant memory.
1 Comment