Autofill Passkeys
Bitwarden offers three passkey features:
Save and autofill passkeys for other services from your Bitwarden vault.
Use passkeys to log in and unlock your Bitwarden account.*
Use passkeys for 2FA to protect your Bitwarden account.*
* Some authenticators, notably Windows Hello, will not allow you to use a passkey for both login and 2FA.
Passkeys are a secure alternative to traditional passwords that let you log in to apps and websites without entering a password. Developed with the standards set by the FIDO Alliance, passkeys bypass vulnerabilities that come with standard passwords, like phishing.
Save passkeys in your Bitwarden vault and use the browser extension, mobile apps, or desktop apps to autofill them across the apps and websites you use every day. Stored passkeys are protected with Bitwarden's trusted end-to-end encryption.
A passkey is a pair of extremely large numbers, called keys, that work together to securely verify your identity. The website stores one key, and the other stays private in your password manager or on your device. Because each passkey works only on the website it was created for, fake lookalike sites can’t trick you into using it.
When logging in to a website or app, you choose to sign in with a passkey and then confirm it’s you. Some passkeys replace your username and password entirely, while others add a step after you enter a password. Depending on the site and type of passkey, confirming it's you might mean unlocking Bitwarden or using your device’s PIN, pattern, or biometrics, such as your fingerprint or face.
Passkeys vary based on where they’re stored and how they’re used:
Synced or device-bound: Synced passkeys, like those stored in Bitwarden, are available across devices where you use Bitwarden. Device-bound passkeys live on a single piece of hardware, such as a YubiKey, and can’t be copied.
Discoverable or non-discoverable: Discoverable passkeys let you sign in without entering a username or password. Non-discoverable FIDO2 credentials are typically used for 2FA after entering your password.
Discoverable passkeys and non-discoverable FIDO2 credentials can be stored in Bitwarden and used to log in to websites with passkey capabilities. Passkeys saved in Bitwarden are synced between devices where you use Bitwarden.
Some passkeys support the PRF extension, which lets them generate an encryption key. To unlock your Bitwarden vault with a passkey instead of your master password, you’ll need a passkey that supports PRF.
Storing and using passkeys is available with the Bitwarden browser extension, mobile apps, and desktop apps.
Bitwarden will not prompt or allow you to save a passkey in your vault that's used to log in to any Bitwarden account. This prevents the circular problem of needing access to your vault to log in to the very same vault.
The browser extension will not offer to save or use a passkey for any domain included in the excluded domains list.
Allow passkeys with the browser extension
First, open the Bitwarden browser extension and go to Settings → Notifications. Verify that the Ask to save and use passkeys option is checked.
If there are specific sites you do not wish to use Bitwarden for passkeys with, set excluded domains.
Create a passkey
When creating a new passkey on a website or app, the browser extension will prompt you to store the passkey:
Select Use your device or hardware key if you do not wish to store the passkey in Bitwarden.
Only one passkey can be saved per login item. If a passkey already exists for a service, overwrite the existing passkey or select the Add icon to create a new login item to store an additional passkey:
Sign in using a passkey stored in Bitwarden
First, confirm that the Ask to save and use passkeys extension setting is turned on. Then start the passkey login on the website. From the window that appears, select your saved passkey:
Alternatively, the inline autofill menu can also be used to authenticate with passkeys.
If you previously selected Use your device or hardware key, Bitwarden will not offer to enter or save a passkey. If you clicked this by accident or change your mind, remove the website from blocked domains. The next time you go to that service's login screen, Bitwarden will ask to save your passkey.
Saved passkeys can be accessed from any Bitwarden app. Within the login item, the Passkey field displays the date and time that the passkey was created:
If master password re-prompt is used on the login item, you're required to re-enter your master password to access the passkey.
To delete a passkey from a vault item:
Open the item Edit screen from the Password Manager web app, browser extension, or desktop app.
Select the Delete icon for the Passkey field:
Delete a passkey Select Delete to confirm.
Select Save.
Passkeys are included in JSON exports generated by Bitwarden and, once exported, can be imported to a Bitwarden account.
On mobile, passkeys can also be imported and exported directly using the FIDO Credential Exchange Protocol (CXP), on iOS 26+ and Android 14+. Both applications must support CXP.