Make Passkey Unlock feature in web app work for login too

[FarrelF]

Prerequisites

• I have searched existing issues and this is not a duplicate
• I have updated to the latest version and the issue still occurs

Platform

Web App (Browser)

App Version

0.29.5

Operating System

Windows

Browser (if applicable)

Other

What happened?

Hi there,

Previously, I had enabled the ‘Passkey Unlock’ feature in the ‘Security settings’ on AliasVault Web, and I was able to unlock the vault using the passkey when it was locked.

However, things are different when I logged out from account. To log back in, after entering my username/email/vault name, I had to enter my password and 2FA code if two-step authentication was enabled, so I couldn’t log in at all using the Passkey.

After successfully unlocking the same vault, when I go to ‘Security settings’, the ‘Passkey Unlock’ feature is disabled, even though I had enabled it earlier. I tried locking the vault again using the G+L keys on the keyboard; I was only prompted to enter my password and could not use the passkey, meaning the feature is indeed no longer enabled.

My expectation is that upon logging in, I should be prompted to select the Passkey I saved during login to use the Passkey, or that the Passkey should appear after I enter my username/email/vault name, so that I can use the Passkey to unlock the vault.

Furthermore, the ‘Passkey Unlock’ feature should not become disabled if I log out and then log back in.

Screenshots or Screen Recording

There is a screen record video:

2026-06-14.18-36-43.mp4

Additional Context

Any (technical) error messages or logs

I don't see any technical logs in AliasVault Web, so maybe not yet.

Does this happen every time or intermittently?

Every time I logout and login to the account, it doesn't happen if I only lock the vault.

Did this start after a recent update?

I don’t know; I haven’t been using AliasVault for very long either.

Are you using self-hosted or cloud version?

Cloud version.

Any browser extensions or security software that might interfere?

No? I'm using private mode in web browser for doing test and there is no another extension being active except cookies.txt exporter and Microsoft Rewards, so I don't think that there is an extension interfere.

And as you can see in the video that I don't using any extension to using passkey, I scan the QR code that appeared from Windows Passkey dialog on my phone, so I don't think there is an security software interfere either.

There is what I'm using for access AliasVault Web:
OS: Windows 11 Pro 25H2 (26200.8457) AMD64
Browser: Vivaldi 8.0.4033.46

[lanedirt]

Hi @FarrelF,

Thanks for the detailed report and video! What you're seeing is currently expected behavior rather than a bug.

The current Passkey Unlock feature is designed as a local quick-unlock mechanism and does not actually replace your master password for logging into AliasVault. It only works for unlocking an active local session on the same device and browser where it was configured. After you log out, the authenticated session is removed, so you must sign in again using your master password (and 2FA if enabled). As a result, the local Passkey Unlock setup is also cleared and needs to be re-enabled.

We are exploring support for full passkey-based login in the future (it's on the v1.0 roadmap), but that functionality is not implemented yet.

The description in the settings UI already mentions that the feature is meant for quick vault unlock and only works on the current device and browser, but perhaps we could tweak the wording to more explicitly state that it cannot be used for account login and that logging out will disable the local unlock setup.

For now I'll mark this as a potential feature enhancement instead of a bug.