Passkeys: Overview, Setup, and Troubleshooting

Last updated: November 3, 2026

Passkeys are a passwordless authentication method based on public-key cryptography. They are designed to make signing in to Paxos more secure and efficient than traditional passwords.

When a passkey is created, a unique key pair is generated: a public key is stored by the service, and a private key is securely stored on the user’s device, hardware security key, secure enclave, or supported password manager. To sign in, the user proves they have the private key, often by using biometrics, a device PIN, or a hardware key. The private key is never transmitted to Paxos.

Why Paxos uses passkeys

Passkeys help reduce account takeover risk and improve the login experience because they are unique to each account and tied to the real website or application.

  • More resistant to phishing: Passkeys are tied to a specific website or application, making it much harder for attackers to trick users into entering credentials on a lookalike site.

  • No reusable password to steal: Paxos does not need to store a user’s private key. If a service is breached, public keys alone are not useful without the matching private keys.

  • Stronger authentication by design: Passkeys rely on something the user has, such as a device or hardware key, and often something the user is or knows, such as biometrics or a device PIN.

  • Fewer password hygiene issues: Users do not need to create, remember, reuse, or rotate passwords for passkey-based sign-in.

Setting up a passkey

To set up a passkey, go to the Paxos Dashboard sign-in page and enter the email address associated with the Paxos account. If prompted, enter the one-time verification code sent by email, then follow the on-screen steps to create and save a passkey.

Users may be prompted to save the passkey to a device, browser, hardware security key, or password manager. Paxos recommends using a trusted passkey provider such as iCloud Keychain, Windows Hello, Google Password Manager, 1Password, Keeper, or another supported password manager or security key.

If passkey creation fails or the page freezes during account creation, try again from a fresh browser window, another supported browser, or another device. If available, saving the passkey to a phone or password manager may work when a device-bound passkey does not.

Signing in with a passkey

To sign in, go to the Paxos Dashboard, enter the email address associated with the account, and choose the passkey sign-in option. The device, browser, hardware key, or password manager where the passkey is stored should prompt the user to approve the login.

If the expected passkey prompt does not appear, check the password manager or device where the passkey was originally saved. For example, if the passkey was saved in Keeper, 1Password, iCloud Keychain, Google Password Manager, Windows Hello, or a YubiKey, that provider may need to be unlocked or selected during sign-in.

Adding or using multiple passkeys

Customers commonly ask whether they can add an additional passkey or use another device. Where account settings allow passkey management, users should add backup passkeys for trusted devices or password managers to reduce the risk of being locked out if one device is lost or replaced.

If a user cannot add a passkey or needs an existing passkey removed, they should contact Paxos Support. Paxos may need to verify identity or account authorization before resetting passkeys or clearing registered passkeys from the account.

If you lost access to your passkey

If the device, browser profile, hardware key, or password manager that stores the passkey is no longer available, try the following:

  1. Check whether the passkey is synced to another trusted device or password manager account.

  2. Try signing in from the same device, browser, or password manager originally used to create the passkey.

  3. If account recovery was set up, use the Recover Account option and follow the on-screen steps.

  4. If recovery is not available or security questions were not set up, contact Paxos Support for assistance.

Account recovery may only be available if a passkey and required recovery options were already set up. If a user has not created a passkey yet, they may need to sign in, enter the one-time email code, and complete passkey setup before recovery options are available.

Incorrect PIN or Windows Hello errors

If Windows displays an incorrect PIN error while using a passkey, the passkey may be associated with Windows Hello and the user is being asked for the Windows Hello PIN for that device. This is different from a Paxos password.

To troubleshoot Windows Hello PIN issues:

  1. Restart the Windows device and try again. Windows may temporarily lock Windows Hello after repeated incorrect PIN attempts as a security control.

  2. Confirm that the PIN being entered is the Windows Hello PIN for that device.

  3. If available, select “I forgot my PIN” and follow the Windows recovery steps.

  4. Reset the Windows Hello PIN through Windows Settings > Accounts > Sign-in options > Windows Hello PIN.

  5. After resetting the PIN, return to the Paxos Dashboard and try passkey sign-in again with the new Windows Hello PIN.

Windows does not provide a way to view the current Windows Hello PIN. If the PIN is forgotten, it must be reset through Windows using the user’s Microsoft account or organization-managed recovery flow.

Device-bound passkeys, work devices, and hardware keys

Some passkeys are device-bound, meaning they are stored only on a specific device or hardware security key and may not sync automatically to other devices. If a user created a passkey on one machine and then tries to sign in from another, the passkey may not be available unless it was stored in a synced password manager or portable hardware key.

For work-managed devices or business email accounts, organization policies may affect whether passkeys can be created or synced. Users should check with their organization’s IT team if a work device, browser, or email environment blocks passkey creation.

Hardware security keys such as YubiKeys may be used where supported. If the prompt does not appear, confirm the key is connected, unlocked if needed, and selected as the authentication method.

Email verification code issues

Some passkey setup or recovery flows require a one-time code sent by email. If the code does not arrive:

  • Check spam, junk, promotions, and filtered folders.

  • Search the inbox for emails from Paxos.

  • Confirm the inbox is not full.

  • Check whether the email provider or organization is blocking automated emails.

  • Wait a few minutes before requesting another code.

If the code still does not arrive, contact Paxos Support and include the email address associated with the Paxos account.

When to contact Paxos Support

Contact Paxos Support if passkey setup fails repeatedly, the user cannot access the device or password manager where the passkey is stored, the account recovery flow is unavailable, a passkey needs to be reset, or the user continues to see errors after trying another browser or device.

To help Support investigate faster, include the account email address, the exact step where the user is stuck, the error message, the device and browser being used, whether a password manager or hardware key is involved, and a screenshot of the error if available. Do not include passwords, full MFA codes, private keys, seed phrases, or other sensitive information.