Log in with Device

Did you know you can log in to the web vault using a secondary device instead of your master password? Logging in with a device is a passwordless approach to authentication, removing the need to enter your master password by sending authentication requests to any mobile device you're currently logged in to for approval. Learn about our zero-knowledge encryption implementation.

Hinweis

Logging in with a device is currently only available on the Bitwarden cloud server (https://vault.bitwarden.com).

Prepare to log in with a device

To set up logging in with a device:

  • Log in normally to the web vault at least once so that Bitwarden can recognize your browser.

    Hinweis

    Using Incognito mode or Private Browsing prevents Bitwarden from registering your browser, so you won't be able to log in with a device in a private browser window.

  • Log in normally to your mobile app at least once so that Bitwarden can recognize your device.

  • On the mobile app, open the Settings tab and, in the Security section, turn on Approve login requests.

Hinweis

If, as a member of an Enterprise organization, you are subject to the require SSO policy, you won't be able to use the Login with device option. You'll need to use SSO to log in instead.

Logging in with a device

On the login screen of the web vault, enter your email address and select Continue. Then, select the Log in with device option:

Log in with a device |
Log in with a device

Using Log in with device will send authentication requests to any mobile apps that you're currently logged-in to, and have enabled the option on, for approval. Requests expire after 15 minutes if they aren't approved or denied. If you aren't receiving login requests, try manually syncing your vault from the mobile app.

Hinweis

If you use the Login with device option, you'll still need to use any currently active two-step login method.

How it works

When logging in with a device is initiated:

  1. The web vault client POSTs a request, which includes the account email address, a unique auth-request public keyª, and an access code, to an Authentication Request table in the Bitwarden database.

  2. Registered devices, meaning mobile app clients that are logged in and have a device-specific GUID stored in the Bitwarden database, are provided the request.

  3. When the request is approved, the mobile app client encrypts the account's master key and master password hash using the auth-request public key enclosed in the request.

  4. The mobile app client then PUTs the encrypted master key and encrypted master password hash to the Authentication Request record and marks the request fulfilled.

  5. The web vault client GETs the encrypted master key and encrypted master password hash.

  6. The web vault client then locally decrypts the master key and master password hash using the auth-request private key.

  7. The web vault client then uses the access code and fulfilled authentication request to authenticate the user with the Bitwarden Identity service.

ª - Auth-request public and private keys are uniquely generated for each passwordless login request and only exist for as long as the request does. Requests expire and are purged from the database every 15 minutes if they aren't approved or denied.


Sprache
© 2023 Bitwarden, Inc.
NutzungsbedingungenDatenschutzerklärungSitemap