Opening a vault with a passkey
In our August release we built a way for a passkey to sign you in and open your Essence vault in one step, with no password. We hold only a locked copy of the vault key, and we cannot open it.
Passkeys are the better way to sign in. There is nothing to type, nothing to reuse across sites and nothing for a fake login page to capture. At Essence, though, signing in was only half of reaching your data. Your vault is encrypted on your device, and the key that opens it came only from your password. So you signed in with a passkey, and then typed your password anyway.
In our August release we built the change that removes that second step. With it, a passkey signs you in and opens your vault in one go, with no password typed.
Why the vault needs a key of its own
An Essence vault is encrypted on your device. Opening it needs a key, and we never hold that key. That is deliberate: a vault we cannot read is a vault nobody can make us read.
A passkey is a different kind of credential. It lives on your phone, laptop or security key, and proves who you are without any secret being typed or sent. The new design lets it open the vault as well, without changing who can read what.
How a passkey opens the vault
When you add a passkey as a way into your vault, your device makes a locked copy of the vault key, using a secret that only that passkey can produce. We store the locked copy, along with identifiers that are not secret. The secret that opens it never leaves your device.
When you next sign in with that passkey, your device produces the secret again, opens the copy and opens your vault. We see that you signed in. We never see the secret or the key.
That arrangement protects you in three ways.
A breach of our servers does not expose the key. Anyone who took the stored copy would hold something locked with a secret that exists only on your passkey, and there is no password behind it to guess.
A stolen device is not enough. Opening the vault needs you to verify on the device itself, with a fingerprint, face or PIN. A locked phone in someone else's hand cannot produce what is needed.
A fake website gets nothing. Passkeys are tied to the real Essence site, so a page imitating it cannot get one to produce the secret.
Living with it day to day
You can add more than one passkey. Each device or security key gets its own locked copy, and each opens the same vault.
You add a passkey while your vault is open, and confirm your password once. That confirmation is what binds the passkey to your vault.
Whether a passkey can open a vault depends on the browser and the authenticator. Where they support it, the passkey does the whole job. Where they do not, it still signs you in, and the app tells you that your password will open the vault on that device. It never sets up a passkey that looks as if it will open your vault and then does not.
On a new device, you open your vault first with your password, from a device already paired or through recovery, and then add a passkey for next time.
Losing a passkey, or even all of them, does not lose you the vault. Your password and your recovery options still work. The design requires that removing a passkey deletes its locked copy, so that a removed passkey can no longer open anything.
What this means for you
A better way to sign in now does the whole job, and every password you no longer type is one that cannot be phished on the way in. For an organisation rolling Essence out to staff or customers, that is passwordless access without asking anyone to trust us with their keys.
If passwordless access to encrypted data is in your plans, we would be glad to walk you through how this works.
Published 6 August 2026