Unlocking with Touch ID, Windows Hello or a passkey

Your vault key is made on your device when you set up the vault, and it stays there. What unlocks it depends on where you are.

Which lock you'll use

• Mac: Touch ID. The key sits in the macOS Keychain.
• Windows: Windows Hello: your face, fingerprint or PIN. The key sits in Windows Credential Manager.
• Linux: a password, through your system keyring (Secret Service).
• Browser: a passkey, if your browser and device support it. Otherwise a passphrase you choose. Make it a long one.

Set it up

You can do this during onboarding, or later:

1. Open Secrets in the sidebar.
2. Choose to set up your vault.
3. Confirm with Touch ID, Windows Hello, your password or your passkey.
4. You're offered a recovery key: 24 words. Write it down somewhere safe. It's optional, but without it we can't help you get your vault back. See Lost device and recovery key.

Unlocking and locking

The secrets list stays locked until you open it. Saying a secret into a call always asks for your fingerprint, face, password or passkey first, even when the vault is open. When you're done, Lock now closes it straight away.

Using more than one device

By default your vault lives on one device only. You can switch on sync: your secrets are then uploaded encrypted, and our servers only ever see scrambled data they can't open.

To add a device:

1. Sign in on the new device and open Secrets.
2. It shows a QR code. Scan it with a device that already has your vault.
3. The two devices hand over the key between them. Our servers only pass along encrypted data.

The list of devices with access to your vault is on the same screen, and under Settings → Devices. Remove any you don't use any more.