Security keys and passkeys
Add a YubiKey, or a passkey built into your phone or laptop, as a second step at sign-in. How to add, name and remove one — and what it is not.
A security key is a small USB or NFC device, such as a YubiKey. A passkey is the same idea built into your phone or computer — it uses your fingerprint or face. When you sign in, you touch the key or use your fingerprint instead of typing a code.
A security key is a second step, equal to the authenticator app. It is never a sign-in on its own — your username and password always come first — and it is not an unlock method: it does not open your mailbox, and it does not replace your password or passphrase. Set up as many second steps as you like; any one of them lets you in.
Web app only for now. The shipping Private.Ki app for Android (1.0.0) has no security-keys screen — on Android the second step is the authenticator app. Add and remove keys in the web app at app.privateki.net; an account that has keys keeps them whatever device you sign in on.
Add a key or passkey
- Open Settings › Security and privacy. Under Two-step verification, open Security keys and passkeys. With none set up yet the screen says No security key or passkey yet.Web & desktop screenshotSecurity and privacy → Two-step verification → Security keys and passkeys, before the first key.This capture is produced by the screenshot pipeline and will appear here.
Security and privacy → Two-step verification → Security keys and passkeys, before the first key.Web & desktop iPhone screenshotSecurity and privacy → Two-step verification → Security keys and passkeys, before the first key.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.Security and privacy → Two-step verification → Security keys and passkeys, before the first key.iPhone Android screenshotSecurity and privacy → Two-step verification → Security keys and passkeys, before the first key.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.Security and privacy → Two-step verification → Security keys and passkeys, before the first key.Android - Click Add a security key or passkey. A dialog asks for a name first — First give it a name, so you recognise it later in the list. Examples it offers: "Blue YubiKey", "This iPhone", "Work laptop". Up to 40 characters; an empty box is refused with Give it a name first.Web & desktop screenshotThe name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.This capture is produced by the screenshot pipeline and will appear here.
The name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.Web & desktop iPhone screenshotThe name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.iPhone Android screenshotThe name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The name comes first: “Blue YubiKey”, “This iPhone”, “Work laptop”.Android - Click Continue. Your browser or phone takes over: Next, your phone asks you to touch the key or use your fingerprint or face. That takes a moment and is all there is to it. Plug the key in and touch it, or confirm with your fingerprint.Web & desktop screenshotThe browser's own prompt does the rest.This capture is produced by the screenshot pipeline and will appear here.
The browser's own prompt does the rest.Web & desktop iPhone screenshotThe browser's own prompt does the rest.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The browser's own prompt does the rest.iPhone Android screenshotThe browser's own prompt does the rest.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The browser's own prompt does the rest.Android - The key appears in the list with the name you gave it and a second line such as Passkey · Added 20 Sep 2026 · Never used. A toast confirms "Blue YubiKey" added.Web & desktop screenshotThe key in the list, with the one-time nudge to add a spare.This capture is produced by the screenshot pipeline and will appear here.
The key in the list, with the one-time nudge to add a spare.Web & desktop iPhone screenshotThe key in the list, with the one-time nudge to add a spare.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The key in the list, with the one-time nudge to add a spare.iPhone Android screenshotThe key in the list, with the one-time nudge to add a spare.Same screen as on the web, single column. This capture is produced by the screenshot pipeline and will appear here.The key in the list, with the one-time nudge to add a spare.Android
If it is your only second step, the screen nudges you once: Good — now add a second one — One key can be lost. With a spare, or an authenticator app, you always have another way in. That is worth doing.
Add more than one and keep a spare somewhere safe. If you lose a key, sign in with any other way you set up and remove the lost key here. If your only second step is a key you then lose, the way back is support and your recovery address — there are no backup codes.
If the dialog refuses
| Message | What it means |
|---|---|
| This browser cannot add a security key or passkey. Open Private.Ki in a current browser on the device the key is for. | The browser has no support for it. Use a current Chrome, Safari, Edge or Firefox. |
| Nothing was added. Try again when you are ready. | You dismissed the browser's own prompt, or it timed out. Nothing changed. |
| This key is already set up for this account. | That key is in the list already, perhaps under another name. |
| Could not add the key. Try again. | Something else went wrong; nothing was saved. |
Sign in with one
After your username and password, the second-step screen says Confirm it's you — Use one of your security keys or passkeys. Touch the key, or use your fingerprint or face. Click Use security key or passkey and answer your browser's prompt.
If you also have an authenticator app, Enter a code from your authenticator app instead switches faces, and the code screen offers Use a security key or passkey instead the other way. A browser without support says This browser cannot use security keys. Enter a code instead.
Rename or remove a key
Each row has a ⋮ menu with Rename and Remove.
- Rename opens a small dialog; type the new name and click Save.
- Remove warns you what you are giving up — This passkey will no longer sign you in. You can still use your other ways in: followed by the list of what remains. Click Remove and a toast confirms "Blue YubiKey" removed.
Removing your last second step is different. The dialog is headed Turn off two-step verification? and says so plainly: "Blue YubiKey" is your last way to confirm it is you. If you remove it, two-step verification turns off and your password alone signs you in. It offers Keep it — add another way first and Remove and turn off two-step verification, with the hint To keep it on, add another key or an authenticator app first.
What our server sees
Cannot see
- Your fingerprint or face — Private.Ki stores only a public key and the name you give it. Your fingerprint or face never leaves your device.
- Your mail, chats or attachments — a second step has nothing to do with encryption
- Your passphrase or private key
Can see
- The public key of each security key or passkey, the name you typed, and the dates it was added and last used
- That a confirmation succeeded or failed
The app says it in one line under the section: A security key or passkey is the strongest: a fake sign-in page cannot use it. A key answers only to the real Private.Ki address, so a phishing page that collects your password and your six-digit code gets nothing it can replay. An authenticator code can be typed into the wrong page; a key cannot.
Common questions
Can I sign in with only a passkey, no password?
No. It is a second step, always after your username and password. There is no passwordless sign-in.
Can I use it to unlock my mailbox instead of my passphrase?
No. Unlocking is a separate thing — see Choose your unlock method. A key confirms who is signing in; your password or passphrase is what decrypts your keys.
Why can't I find it in the Android app?
It has not shipped there yet. Set your keys up in the web app; on Android, use the authenticator app as your second step. Whichever you use, the account is the same.
I named a key and now I can't tell which one it is.
Rename it from the ⋮ menu. The second line of each row — Security key · Added 12 Sep 2026 · Last used today — is usually enough to identify the one you are holding: use it, then look for the row that says Last used today.
How many can I add?
As many as you like. A key you no longer have should be removed, so the list stays a list of keys you can actually reach.