G3NOSYSTEMS
MoatKey · Help

Passkeys (Beta)

Last updated October 23, 2026

MoatKey can store passkeys in your encrypted vault and use them to sign in. This is a Beta feature of the browser extension for Chrome and Edge, and it is off by default. It is not in the phone apps yet.

Turn it on

  1. Open MoatKey’s full view and go to Settings → Saving & filling.
  2. Tick Use MoatKey for passkeys.
  3. Your browser asks once to let MoatKey read secure (https) sites. This is the same optional permission that Offer to save logins uses. There is no new permission at install time.

When both switches are off, MoatKey hands that access back to the browser.

What it does

When a site asks to create or use a passkey, MoatKey can store it in your encrypted vault and sign in with it. A passkey is an ordinary encrypted item, so it syncs with your other items. A passkey made in Chrome works in Edge too. No private key is ever shown, copied or exported as text.

A site that insists on proof that it is really you (user verification) makes MoatKey ask for your master password or unlock check. Otherwise MoatKey signs in without asking again.

Use another device or passkey

MoatKey always offers Use another device or passkey. That hands the request back to your browser, so the browser’s own sheet, Windows Hello, security keys and passkeys on your phone still work.

Passkeys in a shared Castle

Everyone who can open a shared passkey holds its full private key. To the site, they all look like you. Creating one in a shared Castle needs the Editor role or higher, and MoatKey warns you first. Viewers can sign in with shared passkeys; they get a warning too.

Removing someone does not revoke the passkey. A person who was in the Castle could have kept a copy of the key. To really stop it, delete that passkey at the website and make a new one.

Limits

  • The phone apps cannot create or use MoatKey passkeys yet. Sign-in on Android and iPhone comes later.
  • MoatKey works only in the top frame of secure (https) pages. Pages that show the sign-in inside a frame, localhost, security keys and sign-in by scanning a phone QR code fall back to the browser.
  • Passkeys count toward the 50-item limit on the Free plan.
  • Encrypted backups include passkeys. The plain CSV export never does, and Secure Drop refuses them.
  • Because this is a Beta, keep a way to sign in that does not depend on it until you trust it.

Still need help? Email support@moatkey.com.