Authentication7 min read•
Discoverable credentials explained: passkeys, resident keys and phishing-resistant login
Discoverable credentials let you sign in without typing an identifier, with a private key that never leaves your device. Here is how they work, where they fail, and how they fit a zero-knowledge vault.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.
What a discoverable credential is A discoverable credential — historically called a *resident key* — is a WebAuthn credential stored on your authenticator (phone, laptop secure enclave, security key) together with enough information to identify the account. That is what allows a truly usernameless login: the browser asks the authenticator "which accounts do you hold for this site?", and you pick one.
A non-discoverable credential requires the site to tell the authenticator which credential ID to use, which means you must identify yourself first.
Why it is phishing-resistant The credential is bound to the origin. A lookalike domain cannot trigger a signature for the real site, because the browser refuses to use a credential registered for another origin. There is no shared secret to type, replay or leak, and no code to read from an SMS.
Where the private key lives Inside the authenticator, protected by the device's biometric or PIN. It is never transmitted. The site stores only the public key and a credential identifier.
Practical limits worth knowing - **Storage is finite** on hardware keys: discoverable credentials occupy slots. - **Synced passkeys** move between your devices through a platform account, which is convenient but ties the credential's availability to that platform. - **Device loss** requires a second factor or a recovery path, which is exactly why recovery design matters more than the login itself.
The crucial distinction in a zero-knowledge product A passkey proves *who you are* to the server. It does not, by itself, decrypt anything. In DRIVUNO, the account key that opens your data is derived from your password with Argon2id on your own device. Authentication and decryption are deliberately separate concerns.
That is why a strong login cannot rescue a lost password, and why the Recovery Kit exists: a printable, offline key holder that lets you rebuild access without ever giving us the ability to do it for you.
How we use them Passkeys are supported for sign-in and for step-up confirmation on sensitive actions — new device approval, key rotation, administrative operations. Combined with device trust, day-to-day use stays fast; the moments that matter still ask for proof.
What to do today Register at least two authenticators, keep one of them off your main device, and store your Recovery Kit somewhere a house fire would not reach both copies.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.