Passkeys

A passkey lets you sign in with the fingerprint reader, face recognition or PIN you already use to unlock your phone or computer. Nothing is typed and nothing is sent by text or email, so there is no code for anyone to trick you into sharing. A passkey only works on the real FSM Navigator website, which is why it is the strongest way to sign in.

You can keep a passkey on your phone, on your computer, in a password manager, or on a hardware security key.

What works as a passkey

Passkeys saved in iCloud Keychain (iPhone, iPad, Mac) or Google Password Manager (Android, Chrome).
Password managers that store passkeys, such as 1Password or Bitwarden.
Hardware security keys (USB, NFC or Bluetooth) that support a PIN or fingerprint.
Your phone, used from a computer: the browser shows a QR code, you scan it, and confirm on the phone.

Passkeys saved in Microsoft Authenticator are not supported.

Add a passkey

Open Profile, then the Security tab.
In Passkeys, select Add a passkey.
Confirm it's you:
- If you use an authenticator app, enter a code from the app or one of your recovery codes.
- Otherwise, select Email me a code and enter the 6-digit code we send to the address on your account.
Optionally give the passkey a name, such as "Work laptop", then select Create passkey.
Your browser or device asks you to confirm with your fingerprint, face, PIN or security key.

The new passkey appears in the list, and we email you to say a passkey was added. You can hold up to 10 passkeys.

If your company asked everyone to set up a passkey or an authenticator app by a certain date and that date has passed, signing in opens a short Set up two-step sign-in screen instead of the app. Enter the 6-digit code we email you, then choose Add a passkey. You are not asked for a second emailed code, because the one you just entered already confirmed it's you. If you also use an authenticator app, enter its code first. The whole thing has to be done within 15 minutes, and you are signed out when you finish. Sign in again with your new passkey. The full steps are in Multi-factor authentication.

On the sign-in page, choose either:

Sign in with a passkey, below the Sign In button. Pick your passkey and confirm with your fingerprint, face or PIN.
The Email Address box. On many browsers your saved passkeys are offered there as you click into the field. Pick one and confirm.

You don't type your email or password, and you are not asked for another code: the passkey already proves both who you are and that it's really you.

Sometimes we still email a code

If we notice something unusual about a sign-in, we may also email you a one-time code to confirm it. Enter it to finish signing in. This is an extra check on top of your passkey.

Signing in with a passkey from somewhere far from your last sign-in doesn't stop you, because your passkey already proves it's you. Your company still gets the same unusual-location alert it gets for any other verified sign-in.

Use a passkey as your second step

Once you have a passkey, signing in with your email and password always asks for a second step. In the Two-Factor Authentication window, select Use a passkey instead and confirm on your device.

If your company requires a passkey to sign in, that window offers only the passkey. Authenticator app codes and emailed codes are not accepted there. If your company asks for an emailed code to confirm a sign-in and also requires a passkey, sign in with Sign in with a passkey instead of your password.

The same applies when you sign in with Google, Microsoft or Apple. If that sign-in would need an emailed code and your company requires a passkey, no code is sent. The sign-in page says "Your company requires a passkey to sign in", so use Sign in with a passkey on that page. The mobile app shows the same message over its sign-in screen. On a phone that can't use passkeys, it tells you to sign in on a computer or on a phone that supports passkeys.

Confirm it's you with a passkey

Some actions, such as exporting data or changing security settings, ask you to confirm it's you if you haven't signed in recently. When you have a passkey, the Confirm it's you box offers it first: select Use a passkey and confirm on your device. What you were doing then carries on.

If you can't use your passkey right now, choose another way in the same box, such as Email me a code instead or your authenticator app. If your company requires a passkey to sign in, the box only offers your passkey, because a code would be a weaker check than your company asked for.

Rename or remove a passkey

In Profile, Security, Passkeys:

Rename changes the name shown in the list.
Remove asks you to confirm it's you, the same way as adding one. We email you when a passkey is removed.

If your company requires two-step sign-in or a passkey, you can't remove your only qualifying sign-in method. Add another passkey (or set up an authenticator app, where codes are accepted) first.

"Needs attention"

If a sign-in looked like it came from a copy of one of your passkeys, we block it, mark that passkey Needs attention, and email you. That passkey can no longer be used. Remove it and add it again. If you didn't try to sign in, also change your password.

In the mobile app

The FSM Navigator app for iPhone and Android works with passkeys too, once you have its latest version.

Sign in. On the sign-in screen, tap Sign in with a passkey and confirm with Face ID, Touch ID, your fingerprint or your phone's PIN. The button only appears on phones that can use passkeys.
Second step. After signing in with your email and password, tap Use a passkey instead on the Two-Factor Authentication screen.
Add, rename or remove. Open Settings, then Security, then Passkeys. Adding or removing a passkey asks you to confirm it's you, exactly as on the website. You need an internet connection to manage passkeys.
Older Android phones. Phones that can't create passkeys (Android 8.1 and earlier) show Add a passkey on the web, which opens your security settings in the browser. You can still see, rename and remove your passkeys in the app.
Reminder. If your company asks everyone to set up two-step sign-in, the app's Home screen shows the date to do it by, with a Set up now button that opens Passkeys.

If your company raises its sign-in requirement and the app signs you out, the sign-in screen tells you why. Sign in again with your passkey or authenticator app.

Lost your phone or security key?

Losing a passkey doesn't lock you out for good, because your account still has its password. What to do depends on your company's sign-in requirement.

Your company accepts authenticator app codes too.

Sign in with your email and password, and complete the second step with an authenticator app code, a recovery code, or another passkey. Where your company allows it, you can also use a code we email you.
Open Profile, Security, Passkeys and remove the lost passkey. Add a new one while you are there.

Your company requires a passkey. The lost passkey is still on your account, so it is still the only thing accepted as your second step; an emailed code or an authenticator code won't work instead. Ask your company Owner to remove your passkeys. They give a reason, and we email you when it is done. Then sign in with your password and add a new passkey. You get a fresh grace period to do it.

If a wrong-code lock is what's stopping you, the Owner can also clear it from the Users page. See Locked out after wrong codes.

For Owners

On Company Settings, Security, a line shows how many of your team use a passkey. To remove every passkey from someone who lost their device, select Remove passkeys on their row and give a reason of at least 10 characters. You can't do this for your own account; use Profile, Security instead.

If an Owner changes someone's sign-in email, their passkeys keep working. A passkey saved earlier may still show the old address as its account name in the browser's passkey list.

To require passkeys for everyone, see Sign-in requirement.