Passkeys

A passkey replaces your password. It is stored on your device, in a password manager or on a security key. To sign in, you confirm with your fingerprint, your face or your device’s screen lock.

Encloq uses passkeys for sign-in and to protect your encryption key. Sign-in gives you access to your account. Unlocking with a passkey that holds your encryption key also makes your files and messages readable on that device. A newly added passkey can sign you in, but needs a copy of your encryption key before it can open your encrypted content.

You create your passkey while you sign up. Open Encloq on the device you use most, choose Set up a passkey under New to Encloq? and follow the screens:

From then on, Sign in with passkey signs you in, and Unlock with passkey opens your encrypted files whenever Encloq is locked.

When you choose Add passkey, your device asks where to keep the passkey. It does not have to stay on the computer in front of you:

• Your phone or tablet. Choose the option to use another device. Your browser shows a QR code: scan it with your phone and confirm there. The passkey stays on your phone, and you sign in the same way, by scanning the code.
• A password manager. If yours supports passkeys, it saves the passkey and can offer it on all your devices.
• A security key. A small hardware key that you plug in or hold to your device. Every Encloq plan supports them.

Encloq needs a passkey that can also protect an encryption key. If the one you chose cannot, Encloq tells you before anything changes. Then choose another device, password manager or security key.

Keep at least two passkeys that can unlock your data, for example on your computer and on your phone. If one device is lost, the other still opens everything.

Now either passkey unlocks your files and messages. Once all your devices are set up, you can switch off Allow new passkeys, so that no further passkey can be added. Every new or removed passkey is confirmed by email.

Passkeys are how Encloq expects you to sign in. For the rare device where a passkey cannot be used, you can add a password under Settings › Credentials with Add password, and choose Use password instead on the sign-in page.

A password drastically lowers your account’s security. It can be guessed, reused, leaked or phished, while a passkey is bound to your device and to Encloq and never leaves it. Your account is only as safe as its weakest way in, so add a password only when you really need one.

• Set up an authenticator app under Settings › Authenticator. Every password sign-in then also asks for a six-digit code. Without it, the password alone opens your account.
• Unless the password must open your data, keep it sign-in only: do not copy your key to it, or choose Make sign-in only if it already holds it. It then lets you in, but your files and messages stay locked until a passkey that holds your key unlocks them.
• Use a long, unique password from a password manager, and remove it as soon as you no longer need it. Your security score lists passwords that have not been used for three months.

If your passkey is saved in a password manager that syncs, it is already on your new device: open Encloq, choose Sign in with passkey, then Unlock with passkey. If it is not, use a device that has your passkey:

1. 1On the new device, choose Sign in with passkey and pick the option to use a passkey from another device. Scan the QR code with your phone and confirm there.
2. 2In Settings › Credentials, choose Add passkey to create a passkey for this device.
3. 3Choose Copy encryption key and confirm first with your phone, then with the new passkey. From now on, this device signs in and unlocks on its own.

Signed in with a passkey that cannot unlock your data yet? Encloq shows This passkey can’t unlock your data. Choose Sync from another device and confirm with a passkey that already holds your key.

Act from a device you still have:

1. 1Sign in with another passkey.
2. 2In Settings › Credentials, choose Remove passkey for the lost device.
3. 3In Settings › Sessions, choose Revoke session for the lost device, so that it is signed out.

No other passkey left?

On a new device, choose Set up a passkey, enter your email address and verify the code. This adds a new passkey to your account, unless you switched off Allow new passkeys. It signs you in, so you can secure your account. You can remove passkeys and revoke sessions once the security delay set in your passkey settings has passed.

A new passkey does not recover your encrypted content. It can open your existing files and messages only after your encryption key is copied from a passkey that still holds it. If no such passkey is available, Encloq cannot recover that key or decrypt the content for you. Set up a second passkey with encryption access while you still have access.

Open Encloq in your browser

You opened Encloq inside another app, such as your email or a messenger. Its built-in browser cannot use passkeys. Choose Open in Safari or Open in browser, or open the page in your browser from that app’s menu.

This browser cannot create an encryption-enabled passkey

The selected browser, device or passkey provider does not support the feature Encloq needs to protect your encryption key. Try a compatible browser, another device or a security key. Encloq checks compatibility before completing setup.

Passkey taken over by a browser extension

A password manager answered the passkey request but could not set up encryption. Turn off its passkey feature for Encloq, or use the passkey built into your device.

Passkey setup cancelled

Nothing was changed. Choose Add passkey again when you are ready. You do not need a new code.