Passkeys and logging in #
1. What is a passkey? #
A passkey replaces your password at login. Instead of typing something, you confirm it’s you with your fingerprint, Face ID / Touch ID, your device PIN, or a small USB security key. Nothing secret is ever typed into the page, so there’s nothing for a fake login page to steal.
You keep your normal password too — a passkey is an extra way in, not a replacement for your account.
2. Did something change? #
Yes. We previously used OwnID for passkeys. We’ve now switched to the passkey support built into WP 2FA.
OwnID passkeys stop working on 31 October. After that date, sign in with a new passkey registered through WP 2FA, or with your password as usual.
3. How do I create an account? #
- Go to Login.
- Choose Register.
- Enter your email address and a password, then submit.
Already have an account from before? You don’t need to create a new one — just add a passkey as described below.
4. How do I add a passkey? #
- Sign in to your account.
- Open My Account → 2FA Configuration.
- Click Add a Passkey.
- You’ll be offered two options:
- Add a USB security key — for a hardware key (YubiKey, Google Titan, Microsoft Security Key, or any FIDO2 key).
- Add a Passkey — for your phone, laptop, or password manager (Face ID, Touch ID, fingerprint, Windows Hello, iCloud Keychain, 1Password, Google or Microsoft Password Manager).
- Follow the prompt from your browser or phone — tap the key, or confirm with your fingerprint/PIN.
- Give the passkey a clear name, e.g. “iPhone 14 – personal” or “YubiKey – work”, and save.
Please register more than one passkey — for example your phone plus your laptop. If you lose one device, you can still get in.
5. How do I log in with a passkey? #
- Go to Login.
- Enter your username or email.
- Click Log in with a passkey instead of typing your password.
- Confirm with your fingerprint, face, PIN, or security key.
6. How do I disable or remove a passkey? #
Go to My Account → 2FA Configuration  to see your list of passkeys. Each one shows its name, when it was added, when it was last used, and whether it’s active.
- Disable — the passkey stays in the list but can no longer be used to log in. Use this if a device is temporarily lost or borrowed, so you can re-enable it later.
- Revoke / Remove — deletes the passkey permanently and it can never be used again. Confirm the prompt when your browser asks.
Remove the passkey immediately if a device is lost or stolen, then log in with another passkey or your password.
7. I only ever used OwnID — I don’t think I have a password #
Use Lost your password? on the login page, enter your username or email, and follow the link in the email to set a new password.
Two things to know:
- The reset link expires 24 hours after it’s sent.
- Reset your password and register your new passkey in the same sitting. If you reset your password on 30 October and leave registration for later, you may end up locked out after the 31st.
8. Can I use the same passkey on your site and somewhere else? #
No. A passkey is tied to one site. A passkey you created for another website cannot be used here, and one created here won’t work elsewhere. If you shop on another site that supports passkeys, you’ll register a separate one there.
9. Is a passkey safer than a password? #
Usually, yes. A passkey can’t be guessed, reused on another site, or captured by a fake login page, because the secret part never leaves your device. Passkeys are also resistant to brute-force attacks.
10. What if my passkey isn’t recognised? #
- Update your browser to the latest version.
- Make sure your security key is FIDO2-compliant.
- Check that your device’s fingerprint or face unlock is set up and working.
- Try a different method, or use your password instead.
11. Can I still just use my password? #
Yes. Passkeys are an additional login option. Your password and existing sign-in methods continue to work, including 2FA floating code.]