Passkey Login

Overview

Vaultwarden-Plus includes validated passkey login and PRF unlock support for the official Web Vault and official Chromium extension in the r3 validation track. Passkey login remains disabled by default.

Requirements

• DOMAIN set to the public vault origin.
• PASSKEY_LOGIN_ENABLED=true to opt in.
• Official Web Vault or official Chromium extension for the validated scope.
• Awareness that desktop, Android, and iOS passkey login are not assessed.

Configuration

Required:

DOMAIN=https://your-vault.example.org
PASSKEY_LOGIN_ENABLED=true

Optional for custom or development browser extensions only:

PASSKEY_LOGIN_ALLOWED_EXTENSION_ORIGINS=

Official Bitwarden Chrome, Edge, and Opera extension origins are built in.

Examples

Validated runtime behavior includes Web Vault passkey login, Web Vault PRF unlock, Chromium extension passkey login, Chromium extension PRF unlock, Token2 PIN+ Dual Octo R3.3, grant_type=webauthn, and authenticated sync after login.

Troubleshooting

• If passkey login is unavailable, verify PASSKEY_LOGIN_ENABLED=true and the public DOMAIN.
• Do not add extension origins for official Chromium extensions; they are built in.
• Duplicate Windows passkey picker prompts can occur when an authenticator stores multiple resident credentials for the same RP/user.
• Recovery/fallback hardening and advanced operator controls are not claimed.

Related Pages

• Troubleshooting
• Release & Upgrade Guide

Canonical Documentation

• Passkey Operator Guide
• Passkey MVP Validation
• Known Limitations: Passkey/PRF