Passkeys and account security

A passkey is a way to sign in to SEMAOS without typing a password. Your device holds the key and unlocks it with Face ID, Touch ID, Windows Hello, a PIN or a hardware security key such as a YubiKey. You add passkeys and remove them yourself under Settings → Security. If you reset your password, every passkey on the account is removed and you add your own again afterwards.

How do I sign in with a passkey?

On the sign-in page, enter your email and click Continue. If your account has a passkey, Sign in with passkey is the first option. Click it and your browser or phone asks you to confirm with your face, fingerprint, PIN or security key. Sign in with email code and Sign in with password stay available underneath, so losing a device doesn't lock you out.

How do I add a passkey?

1. Open Settings → Security.
2. Under Add a passkey, type a device name you'll recognize later, such as "MacBook (Touch ID)" or "YubiKey".
3. Under Confirm it's you, enter your password. If your account has no password, or you'd rather not type it, choose Email me a sign-in code, click Send me a code and enter the 6-digit code from the email.
4. Click Add passkey and confirm the prompt from your browser or operating system.

The new passkey shows up in the Registered passkeys table with the date you added it and the date it was last used. You can add one for each device you sign in from.

Why does adding a passkey ask for my password or a code?

A passkey is a new way into your account, and it keeps working after you change your password or sign out of other devices. If someone got hold of a signed-in browser of yours, they could otherwise add a passkey of their own and keep coming back. Asking for your password, or for a code sent to your inbox, means only someone who has one of those can add a passkey.

The code is the same one you can sign in with: the email is titled "Your SEMAOS login code", the code works for 10 minutes and only once, and you can ask for up to 3 codes every 15 minutes. While a code still works, you can get a new one only from the browser that asked for it. On any other browser or device, use the code you already have, or wait for it to expire (at most 10 minutes). No one else can replace a code you asked for unless it has expired or too many wrong guesses have locked it. If someone else asked for a code first, it still went only to your inbox, so use the newest code there. After 5 password tries in 15 minutes, right or wrong (a try where you then cancel the browser prompt counts too), the password option pauses, and you can use a code instead.

The check holds for a few minutes. If you cancel the browser prompt or it times out, enter your password again, or send yourself a new code (each code works only once), and try again.

How do I remove a passkey?

In the Registered passkeys table on Settings → Security, click the remove icon on the passkey's row and confirm. That passkey stops working at once. If it was your only one, you'll sign in with your password or an email code next time. Remove any passkey you don't recognize: it means someone else could sign in as you.

What does resetting my password do to my passkeys?

A password reset removes every passkey on your account, and it signs out every device and browser that was signed in, within about two minutes. A device signed in from before the reset can't add a new passkey in those minutes either. The reset email and the reset page both say so before you choose the new password. The browser you finish the reset in stays signed in.

We do this on purpose. You reset a password when you've forgotten it or when you think someone else has it. If someone else had your account for a while, they could have added a passkey of their own, and a passkey keeps working after the password changes. Removing them all is what makes a reset take the account back completely. Afterwards, open Settings → Security and add a passkey again for each of your own devices.

Does changing my password remove my passkeys?

No. Changing your password from Settings → Security while you're signed in keeps every passkey. It does sign out your other devices and browsers, within about two minutes, while the browser you made the change in stays signed in.

Sign out of all other devices works the same way: it ends every other session and keeps your passkeys. If you think someone added a passkey you don't recognize, remove it from the Registered passkeys table, or reset your password to remove every passkey at once.

What should I do if I think someone else got into my account?

1. Reset your password. On the sign-in page, enter your email, choose Sign in with password, then click Forgot password? below the Sign in button. The reset removes every passkey and signs out every device.
2. Open Settings → Security (you're already signed in in the browser you reset from). Check that Registered passkeys is empty, then add your own passkeys again.
3. If anything else in the account looks wrong, report it to us.