Unlocking 1Password with a passkey replaces the traditional act of entering an account password and Secret Key with a phishing-resistant credential protected by a device. The design can make daily access simpler, but it changes recovery: linked devices and an offline recovery code become essential if a phone or computer is lost. This guide explains the current beta model, its security boundaries and a safer setup for people protecting cryptocurrency accounts.
Last reviewed: September 29, 2026. Unlock with a passkey remains identified as beta in current 1Password documentation. Availability, migration options, supported account types, interfaces and platform behavior can change. Confirm the current workflow in official 1Password Support before changing the only working access method. This independent guide is educational and is not professional security advice.
What does “unlock 1Password with a passkey” mean?
In the passkey model, a cryptographic credential authenticates access to the 1Password account. The user approves with the device’s local security—such as biometrics, a PIN or system password—instead of typing the traditional 1Password account password and Secret Key.
The private part of the passkey remains protected by the chosen authenticator. 1Password stores the corresponding public information needed to verify authentication. A server breach that reveals a public key does not reveal the private key required to sign in.
This is not the same as merely enabling Face ID to unlock an already configured traditional account. The underlying account authentication and recovery model can be different.
Two different meanings of “1Password passkey”
| Feature | What it protects | Where the passkey is used |
|---|---|---|
| Passkey saved in 1Password | An external website or application | 1Password acts as the credential provider for that service |
| Passkey that unlocks 1Password | The 1Password account itself | A device or authenticator proves access to 1Password |
Confusing these creates a circular recovery problem. A passkey for a crypto exchange can be stored inside 1Password, while the credential that unlocks 1Password must remain accessible through its supported device and recovery design.
How a passkey works
A passkey uses public-key cryptography. During registration, an authenticator creates a mathematically related public and private key pair. The service stores the public key; the private key stays with the authenticator.
At sign-in, the service sends a challenge. The authenticator signs it after local approval, and the service verifies that signature using the public key. The private key is not typed into a form or transmitted as a reusable password.
Passkeys are bound to the legitimate service identity. A lookalike phishing domain should not be able to request a valid assertion for the real 1Password origin. This provides stronger resistance to credential phishing than a password or one-time code that a user can type into an imitation site.
Traditional 1Password access versus passkey unlock
| Area | Account password and Secret Key | Passkey unlock |
|---|---|---|
| Primary authentication | Memorized account password plus account-specific Secret Key | Passkey protected by a device or authenticator |
| Phishing resistance | User can be tricked into typing information | Credential is bound to the legitimate service origin |
| New-device access | Account details and account password | Approval from a linked device/browser or current recovery flow |
| Offline recovery artifact | Emergency Kit plus known account password | Recovery code under the current beta design |
| Main dependency | Accurate Secret Key and account-password recovery | Approved devices, passkey access and recovery code |
Neither model removes the need for recovery planning. They place trust and failure risk in different places.
Passkey unlock versus device unlock
Device unlock can let a configured 1Password app open when the operating system has already authenticated the user. Passkey unlock concerns the credential used to authenticate the 1Password account. Both can involve biometrics, but their technical roles are not identical.
Ask four separate questions:
- How was the account originally created?
- How does this device authenticate to the account?
- How does the local app unlock during daily use?
- How will the account be recovered if all devices are lost?
Current beta status
1Password’s current support material still labels account passkey unlock as beta. Earlier public-beta documentation initially focused on new Individual accounts, while later product material discusses wider platform and existing-account support as it rolls out.
Do not assume a screenshot or instruction for one account applies to another. Availability can differ for Individual, Families, Business, managed accounts, new registrations and existing accounts. The authenticated account settings are the best indicator of what is currently available.
What is a device key?
1Password’s published passkey-security design describes a unique device key for each app or browser linked to the account. The device key remains on that device and helps protect the credentials used to unlock account data.
On supported hardware, operating-system security features can provide additional device-key protection. The precise protection varies by platform and hardware. A device that lacks a secure hardware path should not be assumed to offer identical resistance.
What is a linked app or browser?
A linked app or browser is an approved 1Password installation that has completed the account’s enrollment process. Once linked, it can use its own protected device credentials rather than repeating the full new-device procedure for every unlock.
Linking should be treated as granting another access path to the vault. Approve only a personal or managed device that is encrypted, updated and protected by a strong screen lock.
How a new device is linked
Under the current design, an already linked app or browser can help authorize another. The new device presents a linking request or verification step, while the existing device confirms it and provides the required encrypted credential material through the supported protocol.
A unique device key is then generated or established for the new device. After successful enrollment, the new app or browser appears as linked.
Interface details can change, but the security decision is consistent: verify that both devices, the account and the request are yours before approving.
Verification codes are not support codes
A verification code shown while deliberately linking a device belongs only in that live workflow. A scammer may claim the code is needed to verify ownership, cancel an attack or restore a crypto account.
Do not provide it in chat, email, phone or remote-support software. Cancel an unexpected request and review linked devices. Legitimate troubleshooting can use account metadata and diagnostics without asking someone to approve an attacker’s device.
Biometrics, PINs and device passwords
Face ID, Touch ID, Windows Hello and similar systems perform local user verification. The biometric template normally stays within the device security architecture; the service receives a cryptographic result rather than the fingerprint or face image.
Most systems allow a device PIN or password as a fallback. That fallback matters because a short or predictable phone PIN can become the practical key to the passkey. Use a strong device credential, hide it from shoulder-surfing and change it after suspected observation.
What is a 1Password recovery code?
A recovery code is an emergency method intended to restore account access when passkey or trusted-device access is unavailable. Current passkey-unlock guidance treats it as the recovery artifact corresponding to this model.
It is not a daily unlock code, one-time login code or exchange backup code. Protect it against both theft and loss. Anyone obtaining it may still need to satisfy the current recovery process, but it should be handled as a high-impact secret.
Recovery code versus Emergency Kit
| Item | Associated model | Typical role |
|---|---|---|
| Emergency Kit | Traditional account password and Secret Key | Records sign-in address, email and Secret Key; user adds the account password separately |
| Recovery code | Passkey unlock and supported modern recovery flows | Emergency account recovery when devices or ordinary access are unavailable |
Keep the artifact appropriate to the active account model. During migration, preserve the existing recovery information until official instructions confirm it is obsolete and the replacement has been tested.
Where to store the recovery code
A practical recovery design can include:
- a printed copy in a secure location;
- an encrypted offline document whose decryption method is independently recoverable;
- a protected copy held by a trusted person under a clear emergency plan;
- a second geographically separate copy for fire or disaster resilience.
Do not keep the only copy inside the 1Password vault. That is equivalent to storing a safe’s only spare key inside the locked safe.
Avoid recovery loops
A recovery loop occurs when every fallback depends on another credential trapped behind the same inaccessible account. For example:
- The 1Password recovery code exists only in email.
- The email password and passkey exist only in 1Password.
- The phone holding the 1Password passkey is lost.
- The mobile carrier account PIN also exists only in 1Password.
Break the loop with an offline recovery code, an independently recoverable primary email, a second trusted device and a separate strong authentication method.
A safer setup sequence
- Confirm eligibility. Read the authenticated account option and current official beta requirements.
- Update devices. Install operating-system, browser and official 1Password updates.
- Strengthen device locks. Use a strong passcode and enable full-device encryption.
- Inventory current recovery. Preserve the existing Emergency Kit and account information where applicable.
- Create or enable the passkey. Follow the official in-account workflow, not an email link.
- Confirm ordinary unlock. Lock and reopen the app without deleting anything.
- Link a second device. Prefer a device with an independent failure profile.
- Create the recovery code. Store it outside the vault.
- Review linked apps and browsers. Remove obsolete access only after the new setup works.
- Test recovery safely. Verify instructions without erasing the final working access path.
Why two trusted devices matter
One phone can be lost, stolen, damaged or reset. A linked computer or tablet provides another approved path for enrolling a replacement. The devices should not always travel or remain in the same bag, otherwise one event can remove both.
A second device is not a substitute for the recovery code. Theft, fire, malware or account unlinking can affect multiple devices. Use both redundancy types.
How to review linked devices
Open the authenticated 1Password account and locate the current list of authorized or linked apps and browsers. Compare device names, platforms and recent activity with devices you control.
Investigate:
- unknown device names;
- duplicate browser profiles;
- old phones or computers that were sold;
- work devices no longer managed by you;
- activity at unexpected times;
- a newly linked entry after an unsolicited verification prompt.
Unlinking a device
Unlinking removes that app or browser’s approved relationship with the account under the current system. Use the official account interface and verify the exact target before acting.
Do not unlink the last known working device while troubleshooting. Unlinking also does not erase screenshots, exported files, copied passwords or active sessions at external services. A compromised device may require remote locking, wiping and credential rotation.
What to do after losing a phone
- Use another trusted device to open the official account.
- Lock or erase the lost phone through its platform account where appropriate.
- Unlink the lost 1Password installation using official controls.
- Secure the Apple, Google or Microsoft account associated with the device.
- Contact the mobile carrier and protect against SIM replacement if relevant.
- Review critical crypto exchange, email and cloud sessions.
- Rotate credentials that may have been visible or copied.
- Enroll the replacement device from a known linked device or supported recovery flow.
Device loss is not automatic proof that vault data was opened. Respond based on screen-lock strength, device state, remote-management status and the sensitivity of information present.
What if every linked device is lost?
Use the current recovery-code workflow reached through the official 1Password domain. Prepare access to the account email and any required identity or account information. Do not search for a phone number and disclose the recovery code to an unsolicited helper.
If no working passkey, linked device or valid recovery path remains, recovery may not be possible. That is why the offline code must be created and verified before the emergency.
Passkey unlock and browser extensions
A browser extension can become a linked access point under the supported workflow. Protect the entire browser profile: remove unused extensions, install updates and avoid shared or public computers.
A malicious extension may read page contents, alter destinations or steal data the browser can access even if it cannot extract the passkey private key. Passkey phishing resistance does not make the browser trustworthy.
Cross-device passkey prompts
Some passkey workflows display a QR code on one device and ask a nearby phone to approve. Bluetooth can help establish proximity; it is not necessarily used to transmit the vault secret itself.
Scan only a QR code generated by a sign-in you initiated on the correct 1Password domain. A QR code sent in chat or email can enroll or authenticate an attacker’s session.
Passkey unlock while traveling
Before travel, update and test both the primary device and an independent fallback. Do not carry every recovery artifact with every device. Consider the risk of loss, border inspection, hotel access and unavailable mobile service.
1Password Travel Mode controls which vaults remain on a device; it is separate from passkey account recovery. Our guide to 1Password Travel Mode for crypto security covers that workflow.
Why crypto users need a separate plan
A vault may hold the login for a crypto exchange, its email account, passkey, authenticator seed or backup codes. Losing the vault during market volatility or a security incident can block every recovery route simultaneously.
A resilient structure can include:
- two protected linked devices;
- an offline 1Password recovery code;
- independent recovery for the primary email;
- phishing-resistant MFA on exchanges where supported;
- offline exchange recovery codes;
- a separate offline wallet seed backup;
- documented emergency contacts and official support URLs.
Do not store a seed phrase casually
A wallet seed phrase controls onchain assets and has no fraud department or password reset. Storing it in any cloud-connected password manager changes the threat model and can conflict with hardware-wallet guidance.
This article does not recommend using 1Password as the only backup of a long-term wallet seed. Keep wallet recovery material offline according to the wallet provider’s instructions and a tested inheritance plan.
What passkey unlock protects against
- Password phishing: there is no reusable account password to type into a lookalike page.
- Server credential theft: the service stores a public key rather than the private signing key.
- Weak human password selection: the cryptographic key is generated with strong randomness.
- Credential reuse: the passkey is specific to the service.
- Remote guessing: authentication requires possession and local authorization.
What it does not protect against
- malware on an unlocked device;
- an infostealer reading exported or copied vault data;
- remote-control software approved by the victim;
- a weak device PIN observed by a thief;
- theft of an active browser session;
- approval of a malicious device-linking request;
- unsafe sharing of a vault item;
- a compromised recovery email;
- a fake crypto withdrawal voluntarily approved by the user;
- exposure of a seed phrase entered into a phishing form.
Device theft risk
Passkeys move more practical security responsibility to devices. A stolen phone protected by a long passcode and secure hardware presents a different risk from one using a simple four-digit code visible to people nearby.
Enable platform theft-protection features, hide notification content, reduce the screen-lock delay and avoid approving passkey prompts without reading them.
Malware and unlocked-session risk
Passkey cryptography can prevent extraction of a reusable login secret while malware abuses an already authenticated session. It may copy credentials displayed by the vault, alter URLs or wait for the user to unlock the application.
Keep software current, minimize browser extensions, avoid pirated programs and separate high-risk crypto activity from casual browsing. A password manager is not an antivirus or transaction-verification device.
Account recovery is not crypto recovery
Recovering 1Password restores access to its vault contents. It cannot reverse a blockchain transaction, reconstruct a seed phrase never saved or recover an exchange account whose independent checks fail.
Keep recovery plans separated and labelled so an emergency helper knows whether the problem concerns 1Password, email, an exchange or a self-custody wallet.
How to test without locking yourself out
- Confirm two linked devices currently unlock.
- Generate and securely store the recovery code.
- Review official recovery instructions while already signed in.
- Lock one application and unlock it normally.
- Use a secondary browser profile or device for an enrollment test if supported.
- Verify the new entry in the linked-device list.
- Remove only the temporary test entry, not the final working devices.
Do not factory-reset the last phone, delete the only passkey or unlink every browser to “prove” recovery. A test should reduce uncertainty without manufacturing a real disaster.
Migration from password and Secret Key
If the authenticated account offers migration, read the complete current prompt. Preserve the Emergency Kit and existing recovery information until the passkey account works on more than one device and the recovery code has been created.
Check how the change affects family organizers, account recovery, browser extensions and offline access. Business or managed accounts may follow administrative policies rather than the Individual-account process.
Do not confuse sign in, unlock, link and recover
| Action | Meaning |
|---|---|
| Sign in | Authenticate an account or begin access on a new context |
| Unlock | Open a previously configured local app or browser |
| Link | Authorize a new app or browser and establish its device credentials |
| Recover | Regain account access after ordinary methods are unavailable |
Troubleshooting the wrong stage can lead to deleting a working credential unnecessarily.
Passkey not appearing
The passkey may belong to another operating-system profile, authenticator or beta account. Confirm the exact account email, platform account and device used during setup. Update the official app and browser.
Do not install a “passkey recovery” extension or export tool from a search advertisement. Use another linked device or the official recovery process.
QR code does not work
Ensure both devices have current software, Bluetooth is available when required and the QR code is still valid. Cross-device codes can expire. Restart the sign-in from the official page rather than reusing a screenshot.
Never send the QR code to someone else for scanning. It represents a live authentication attempt.
Biometrics do not work
Use the supported device PIN or password fallback where offered. Check that biometric authentication remains enrolled and permitted for 1Password. A device restart or security-policy change can require the system credential again.
Repeated biometric failure is not a reason to disclose the recovery code to support. Diagnose through device settings and official documentation.
New device cannot be linked
Verify that an existing linked app or browser is online and unlocked, the request belongs to the correct account and the verification code is current. Check account-type and platform eligibility.
If no linked device works, move to the official recovery-code flow instead of attempting random codes or creating a second account with the same email.
Unexpected linking request
Reject it immediately. Review the official linked-device list, protect the email account and inspect security notifications. Do not approve simply to discover who initiated it.
If a request followed a support conversation, end the conversation and reach 1Password through a verified channel typed independently.
Common mistakes
- Confusing a passkey stored in 1Password with the passkey that unlocks it.
- Assuming Face ID alone defines the account authentication model.
- Keeping the only recovery code inside the vault.
- Using one linked phone with no secondary device.
- Deleting the old Emergency Kit before migration is complete.
- Using a weak phone PIN as the passkey fallback.
- Approving an unexpected QR code or device-link request.
- Unlinking the final working device during troubleshooting.
- Assuming passkeys protect an already unlocked infected computer.
- Expecting 1Password recovery to restore onchain assets.
- Starting beta migration immediately before travel.
- Ignoring differences between Individual, Families and Business accounts.
Setup checklist
- The option is available in the authenticated official account.
- The beta limitations have been read.
- Every participating device is updated and encrypted.
- Device PINs and passwords are strong.
- The passkey was created through the official workflow.
- At least two independent linked devices work.
- The linked-device list contains no unknown entries.
- A recovery code exists outside the vault.
- The primary email has independent recovery.
- Existing Emergency Kit information is preserved during migration.
- Crypto exchange and wallet recovery do not depend solely on this vault.
Frequently asked questions
Can I unlock 1Password without a password?
Eligible passkey-unlock accounts can use a passkey instead of the traditional account password and Secret Key. Availability depends on the current beta rollout, account type and platform.
Is unlocking 1Password with a passkey still beta?
Current 1Password support documentation labels the feature beta. Confirm status in the official account before relying on it.
Is my fingerprint sent to 1Password?
No. Biometric matching is performed locally by the device. The passkey system produces a cryptographic approval rather than sending the fingerprint or face template.
What happens if I lose the phone containing my passkey?
Use another linked device to enroll a replacement or follow the official recovery-code process. Lock or erase the lost phone and unlink its 1Password installation.
What is a linked device in 1Password?
It is an approved app or browser with its own protected device credentials for accessing the account under the passkey model.
What is the 1Password recovery code?
It is an emergency recovery secret for supported account-recovery flows. Store it outside the vault and protect it from disclosure.
Is a recovery code the same as the Emergency Kit?
No. The traditional Emergency Kit records account information and Secret Key. A recovery code belongs to supported modern recovery and passkey-unlock workflows.
Can I store my recovery code in 1Password?
An additional copy may be convenient, but the only copy must not be inside the account it is supposed to recover. Keep an independently accessible protected version.
Why is my 1Password passkey missing?
It may be stored under another device, authenticator or operating-system profile, or the current account may not support the same beta workflow. Use a linked device or official recovery.
Does passkey unlock protect me from malware?
It reduces theft and phishing of reusable login credentials, but malware on an unlocked device may read displayed data, misuse sessions or alter destinations.
Can someone sign in with my device PIN?
If they possess the relevant device and know its fallback credential, they may be able to authorize the passkey. Use a strong PIN or password and activate theft-protection features.
Should crypto seed phrases be stored in 1Password?
Follow the hardware or software wallet’s recovery guidance. This guide recommends an independent offline backup for long-term self-custody rather than making the online vault the only seed backup.
Final perspective
Passkey unlock can remove two familiar weaknesses: reusable passwords and credentials that users can type into phishing pages. Linked devices also make adding a replacement device convenient when at least one trusted installation remains available.
The trade-off is a stronger dependency on device security and preparation. Link more than one trusted device, create the recovery code before it is needed and eliminate circular dependencies with email and crypto accounts. Passwordless should not mean recoveryless.
Official sources and further reading
- 1Password Support — Security of unlocking with a passkey
- 1Password — Passkey unlock public beta
- 1Password — Passkey versus password and Secret Key
- 1Password — Device unlock and recovery safeguards