Passkeys
A passkey lets you sign in to Paminga with the same thing you use to unlock your device — your fingerprint, your face, or a PIN. No password to type, and no code to copy out of an app.
It's faster than what you're doing now. It's also meaningfully harder to attack.
Why a Passkey Is Safer Than a Password
A password is a secret you know, which means it's a secret you can be tricked into handing over. Phishing works because a convincing fake login page will happily accept your password, and your authenticator code along with it.
A passkey can't be given away, because there's nothing to hand over. The private key stays in your authenticator and is never sent to us or to anyone else — only a signature is. It also only ever proves itself to Paminga, and the browser enforces that, so a lookalike domain gets nothing.
(Some passkeys do sync between your own devices through iCloud Keychain, Google Password Manager, or a password manager. That's a backup channel you control, not something a phishing site can reach. See Where Your Passkeys Live.)
It's also two factors at once: possession of the authenticator, plus user verification — the Face ID, Touch ID, or PIN that unlocks it. That's why, if your organization requires multi-factor authentication, signing in with a passkey satisfies the requirement on its own — you won't be asked for a code as well.
Adding a Passkey
Go to your Passkeys settings and choose Add a Passkey.
Give it a name you'll recognise later — "MacBook Pro," "Work iPhone," "YubiKey" — then follow your device's prompt. That's the whole process.
You can add as many as you like, and you probably should add more than one — particularly if yours are device-bound rather than synced. A device-bound passkey on your laptop won't help you when you're signing in from your phone; a synced one usually will.
Signing In
On the login page, choose Sign In with a Passkey and confirm with your fingerprint, face, or PIN.
Depending on your browser, your passkey may also appear as a suggestion when you click into the email field — pick it and you're in.
You never type your email address. Your device already knows which account the passkey belongs to.
If your organization has turned on Require Okta Single Sign-On, Okta is the only way in and your passkey won't sign you in. Your Okta administrator can grant an exemption if you need one.
Where Your Passkeys Live
Some passkeys sync, and some don't. The Availability column tells you which is which.
Synced to keychain means the passkey is backed up to iCloud Keychain, Google Password Manager, or a password manager like 1Password. It follows you to your other devices, and it survives losing the one you created it on.
This device only means it exists in one place — typically a hardware security key, or a device configured not to sync. If that device is lost, so is the passkey.
That distinction matters when you're deciding how many to add. If all you have is a device-bound passkey on a laptop that goes missing, you'll be signing in with your password until you enroll a new one.
Removing a Passkey
Delete a passkey from your Passkeys settings and it stops working immediately.
Do this when you sell or retire a device, or if one goes missing. Removing a passkey doesn't affect the others.
Adding a passkey doesn't remove your password — it stays as a way back in, which is why it's safe to delete your last passkey. If you'd rather not have one at all, change your password to something long and unique and keep two-factor authentication turned on.
Browser and Device Support
Passkeys work in most current browsers, including Safari, Chrome, and Edge, across macOS, Windows, iOS, and Android. Support varies with the browser version, the device, and how your authenticator is configured — Firefox in particular is less consistent than the others.
The practical answer is to try it. Paminga only shows the passkey option when your browser supports the standard — so if you don't see it, sign in with your password as usual. Seeing it means your browser can run the ceremony, not that a passkey is already enrolled on that device; if none is available, you'll be told and can fall back to your password.
