Passkeys in Autothenticator
Two kinds
| Synced (default) | Kept on one device | |
|---|---|---|
| Where the private key is | In the vault, encrypted, synced end to end | In the device's secure hardware: Android Keystore, Secure Enclave, or the TPM on Windows |
| On a lost device | Still on the person's other devices | Gone: sign in another way and make a new one |
| Accepted where a site insists on device-bound passkeys | No | Yes |
- Every use needs user verification: a fingerprint, face, device PIN, Windows Hello or the passphrase. An unlocked vault isn't enough, because a passkey is a whole sign-in.
- The site check is the browser's or the operating system's, so passkeys can't be phished.
Per platform
- Chrome, Edge, Firefox: the extension answers the site's passkey request and opens its own small window to confirm.
- Device-bound: the browser has no secure hardware of its own, so the extension makes synced passkeys only. On Windows, a passkey that has to stay on the device is handed to Windows, which offers the Windows plug-in.
- Left to the browser: security key requests; sites that don't accept the standard P-256 key; passkeys suggested inside a sign-in box; and everything when passkeys are turned off in settings.
- Use the browser's own instead is always offered.
- Safari: the Apple app is the passkey provider, through iOS and macOS. The Safari extension leaves passkeys alone.
- Android 14 and later: turn Autothenticator on in Android's Passwords, passkeys & accounts. Works in apps and browsers.
- iPhone, iPad, Mac: turn it on in AutoFill & Passwords settings.
- Windows 11: the separate plug-in keeps device-bound passkeys in the TPM, for every browser and app. Turn it on in Settings › Accounts › Passkeys › Advanced options.
Signing in a nearby computer with the phone
The usual QR code and Bluetooth flow ("use a phone or tablet") belongs to the operating system, and works with Autothenticator as the phone's passkey provider.
Identifying the authenticator (AAGUID)
Identity providers such as Entra ID and Okta can allow or block passkey providers by an id called the AAGUID. Autothenticator's are:
| Passkeys | AAGUID |
|---|---|
| Synced (any platform) | 0b82ae55-0637-41d4-94b3-0d87dd0fcc7a |
| Device-bound on Android | 0935e3a0-453a-4960-b318-914b5a0fd60a |
| Device-bound on iPhone, iPad, Mac | bdcb522a-1053-42a3-9a39-f69d416ac09b |
| Device-bound in the Windows TPM | 5b8aead5-bb58-4d02-b69e-6ec1cbd2e7ab |
- No attestation. Autothenticator isn't FIDO-certified, so its passkeys carry no attestation. Identity providers that insist on attestation won't accept them.
- Exporting passkeys to another provider isn't offered.