# Passwordless login using passkeys

**URL:** https://meta.discourse.org/t/passwordless-login-using-passkeys/285589
**Category:** Announcements
**Tags:** new-feature, passkey
**Created:** [November 16, 2023, 5:39pm UTC](https://meta.discourse.org/t/passwordless-login-using-passkeys/285589 "2023-11-16T17:39:57Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [November 16, 2023, 5:39pm UTC](https://meta.discourse.org/t/passwordless-login-using-passkeys/285589/1 "2023-11-16T17:39:57Z")

</div>

Following up on [Support passwordless login with Passkeys](https://meta.discourse.org/t/support-passwordless-login-with-passkeys/229259) and a few weeks of internal testing, we are happy to announce that support for passkeys has now landed in Discourse.

### What are passkeys

Passkeys are a safer, simpler alternative to using passwords for authentication. Creating and using a passkey is now widely supported across platforms and browsers. Compared to passwords, passkeys have better built-in safety due to strong platform-generated credentials and biometric identity validation (like touchID, faceID, PIN or device password). Passkeys are also safe from server-side leaks (the private portion of the key never leaves the device) or phishing (each key is linked with one website/service only).

### Feature Rollout

If you are a hosted customer, passkeys support will be rolled out to your instance over the next few days. If you’d like to enable them right now, please reach out to `@team` here on meta or via email to `team@discourse.org`.

If you are self-hosting Discourse, note that the feature ~~will be enabled by default in Discourse core shortly~~ is now enabled by default in core as of [this commit](https://github.com/discourse/discourse/commit/4d43ef5186db64db9c6f0e91314a9ae1a337290b). If you would like to disable it, you can do so via the Rails console:

```plaintext
launcher enter app
rails c
SiteSetting.enable_passkeys = false

```

Note that passkeys can only be used on Discourse instances with local logins enabled. If your instance doesn’t use local logins, the passkeys feature has no effect.

* * *

Once the feature is enabled, users can add passkeys to their account by going to the security tab of their user preferences:

 ![The image shows a computer screen displaying a login modal with various sign-in options including social and service provider logins, as well as traditional email/username and password fields.](https://global.discourse-cdn.com/meta/original/4X/4/d/7/4d7cc23fd93bb60578ea6d905e1f06ddef4de8e8.png)

Once a passkey is registered, they can login with it via the autofill dropdown under the username field (1) or by clicking on the “Login with a passkey” button (2).

 ![The image shows a computer screen displaying a login modal with various sign-in options including social and service provider logins, as well as traditional email/username and password fields.](https://global.discourse-cdn.com/meta/original/4X/b/3/d/b3db37cfcbf6733f9b4e6fe62de6158636abc877.png)

### More details

There are numerous resources and guides available on passkeys. I have found the following to be the most useful:

- [https://passkeys.dev/](https://passkeys.dev/) maintained by the W3C has a [great chart](https://passkeys.dev/device-support/) detailing device support
- Google provides a [comprehensive developer guide](https://developers.google.com/identity/passkeys)
- Apple’s [Passkeys Overview - Apple Developer](https://developer.apple.com/passkeys/) is useful
- Password managers offer informative guides, too, see [1Password on passkeys](https://1password.com/product/passkeys) or [Bitwarden on passkeys](https://bitwarden.com/passwordless-passkeys/) for examples.

### Possible future improvements

Once the initial rollout of the feature is complete, we may consider making the following improvements:

- Allow setting up a passkey on account creation
- Allow passkeys to be used when confirming sensitive actions (currently supported in the Security tab of User Preferences but not in some admin-only screens)
- Allow removing passwords altogether (on a per-user or per-instance basis?)

---

_[View the full topic](https://meta.discourse.org/t/passwordless-login-using-passkeys/285589)._