Setting up and using a passkey

A passkey is a way of signing in that gives you nothing to remember: your fingerprint, your face or your device's PIN proves that it is you. The data of your fingerprint or face never leaves the device and never reaches us. A passkey is also tied to the CarbonHost website, and when you sign in we check which page it was used on: an approval given on a fake page cannot sign anyone in to your account.

Your password stays: a passkey adds to it, it does not replace it.

Adding a passkey

1. Open the Security section of the Profile page and find the Passkeys and security keys card.
2. Click Add a passkey.
3. Confirm that it is you: enter your current password. If your account already has a second step, we ask for that too: the code from your authenticator app, or an existing passkey. If you already have a passkey, you can confirm with it instead of the password.
4. Click Create passkey, and approve the request from your browser or device with your fingerprint, your face or your PIN.
5. Give it a name you will recognise later, such as the name of the device. You can rename it at any time.

We send you an email when a passkey is added to your account or removed from it. If it was not you, remove the passkey you do not recognise, change your password, and let us know on the Contact page.

Signing in with a passkey

On the sign-in page you can use it in two ways:

• Click the email field: if your browser supports it, it offers the passkeys you have saved. Pick one and approve it.
• Or click Sign in with a passkey.

When you sign in with a passkey, you do not have to type your password.

If your passkey is on your phone, on a computer the browser may offer to use another device. It then shows a QR code: scan it with your phone's camera and approve the sign-in on the phone. Whether this is available depends on your browser and operating system.

As two-step protection

A passkey on your account counts as two-step protection. So when you sign in with your password, after the password we ask for the passkey, or, if your account also has an authenticator app, for its code. You do not have to turn the authenticator app off: it is handy as a backup for when you cannot reach your passkey. Setting up the authenticator app is described in Two-factor authentication (2FA).

A security key (such as a YubiKey)

On the card, Add a security key lets you add a physical security key as a second step. Adding it works the same way: you confirm that it is you, approve the request with the key (plug it in, or hold it to your device), and then name it.

If the key cannot store a passkey, it can only be used after the password, as a second step. You cannot sign in with it alone.

Renaming and removing

In the card's list you can rename or remove each passkey and security key. Once removed, you can no longer sign in with it or confirm changes with it. If you also want it gone from your device or password manager, you have to do that there separately.

If your account must have a second step, you cannot remove the last one: first add another passkey, or turn on the authenticator app.

If it does not work

• If the card says your browser cannot create passkeys, use another browser or device.
• If signing in with the passkey does not work, try again, or sign in with your password.

If you have lost every second step

If you no longer have any passkey, security key or authenticator app, and so cannot sign in, write to us on the Contact page. The page is called "Custom request", but it is the one to use here too: give your account's email address, and say in the message that you have lost your second steps. Do not send a password or a code; we do not need one. Our support team removes the second steps from your account once they have verified your identity, and you can then set up new ones.

You can avoid this: set up at least two methods, for example two passkeys, or a passkey and an authenticator app. If your passkey syncs to the account of your device or password manager, it is on a new device too.