Passkey-X User Guide

Every guide in one place. Updated October 2026.

Download (Word, .docx)

1. Getting started

Create your vault and save your first passwords.

Get started in 5 minutes

Create your account, set your vault password and save your recovery key.

Go to passkey-x.com and choose Start free. Enter your email and a login password, then confirm your email from the message we send you.
Sign in. You are asked to create a vault password. This is different from your login password: it encrypts your vault on your device and we never receive it.
Save your recovery key. Choose Download recovery key and keep the file somewhere safe and offline (for example a USB stick or a printed copy in a drawer).
Confirm you saved it. Your vault opens and the Getting started checklist on Overview shows what to do next.

Tip: Use a long vault password you can remember, such as four or five random words.

Tip: Nobody, including Passkey-X, can reset your vault password. The recovery key is your backup.

Add passwords, cards and notes

Save anything you need to keep private: logins, cards, Wi-Fi, notes and more.

Open Vault and choose Add secure item (or press the + button on Home).
Pick the type: Login, Payment card, Secure note, Wi-Fi, API key and others.
Fill in the fields. Use the generator button next to the password field for a strong password.
Choose Save. The item is encrypted on your device before it is stored.

Tip: Mark items you use often as favourites so they appear at the top.

Import from another password manager

Bring your passwords over from 1Password, Bitwarden, LastPass, Dashlane or your browser.

In your old password manager or browser, export your passwords as a CSV or JSON file.
In Passkey-X open Settings › Data.
Choose the file. Passkey-X shows how many items it found before anything is saved.
Confirm the import, then delete the exported file from your computer: it is not encrypted.

Install the apps and browser extension

Fill passwords in your browser and use Passkey-X on your phone and computer.

Open passkey-x.com/download.
Install the browser extension, the desktop app or the mobile app you need.
Sign in with the same email, then unlock with your vault password.

Tip: Free accounts can use 2 devices at a time. Paid plans have unlimited devices.

Create strong passwords with the generator

Make long, random passwords or easy-to-type passphrases for every account.

Open Generator, or use the generator button next to any password field.
Choose a random password or a passphrase of several words, and set the length.
Copy it or save it straight into a login. The clipboard is cleared automatically after a short time.

Tip: Use a different password for every website. Run a security check to find reused or weak ones.

Switch from LastPass, 1Password, Bitwarden or your browser

Export from your old password manager and import everything into Passkey-X in a few minutes.

Export from your old manager: LastPass (Advanced options › Export, CSV), 1Password (File › Export, 1PUX or CSV), Bitwarden (Tools › Export vault, JSON or CSV), Keeper (Settings › Export, CSV or JSON), KeePass or KeePassXC (XML or CSV), Apple Passwords or your browser (Export passwords, CSV).
In Passkey-X open Settings › Data and choose the file. It is read on your device; nothing is uploaded until each item is encrypted.
Check the preview: Passkey-X shows how many logins, cards and notes it found and skips duplicates.
Confirm the import, then permanently delete the exported file, because it is not encrypted.
Install the browser extension and turn off the old manager's autofill so only Passkey-X fills passwords.

Tip: Teams can move shared folders into organization vaults with the team migration wizard in the Admin console.

2. Apps & browser extension

Autofill in every browser, the desktop app and your phone.

Fill and save passwords with the browser extension

Open passkey-x.com/download and add the Passkey-X extension to your browser.
The extension opens Connect this browser. Approve it in your vault, which must be unlocked.
On a sign-in page, click the Passkey-X key in the username or password field, or open the extension from the toolbar. The badge shows how many saved logins match the site.
Pick the login to fill it. If the site asks for a two-step code, fill it from the same login.
After you sign in somewhere new, Passkey-X offers to save the login. On sign-up pages it can fill a strong new password for you.

Tip: Each browser profile needs its own extension: add it to every profile you use (for example Work and Personal). The desktop app reminds you about profiles that are missing it.

Tip: The extension never fills a look-alike site that imitates one of your saved websites.

Use the desktop app on Windows, macOS and Linux

A focused vault on your computer with quick access, security checks and alerts that pop up even when the app is minimized.

Download the installer for Windows, macOS or Linux from passkey-x.com/download and install it.
Open Passkey-X and choose Sign in. Your browser opens so you can approve the sign-in, then return to the app.
Unlock with your vault password. You can then turn on fingerprint or face unlock where your computer supports it.
Use quick access to search and copy a login without opening the full window, or auto-type it into another program.
Leave the app running: dangerous links, swapped wallet addresses and serious security problems open an alert window, and warnings appear as a small notification in the corner.

Tip: This computer › Settings lists every protection (Shield, browser watch, network watch, device health). Your organization may require some of them.

Tip: Open This computer › Device health to see whether your computer and every browser profile are protected.

Use Passkey-X on your phone

Reach your vault on Android and iPhone, with a quick search and favourites.

On Android, download the Android app from passkey-x.com/download and install it.
On iPhone, open passkey-x.com in Safari, tap Share, then Add to Home Screen.
Sign in with the same email and unlock with your vault password.
Mark logins as favourites so they appear first on your phone.

Tip: Free accounts can use 2 devices at a time. Paid plans have unlimited devices.

Use Passkey-X in an Android work profile

Install it in the work profile and let IT set it through your MDM (Intune, Workspace ONE, Google).

Your IT team adds Passkey-X to your work profile. It shows a briefcase badge.
IT can require the work profile, ask for your fingerprint before any password is shown, and shorten how long copied passwords stay on the clipboard.
On any phone you can protect your most sensitive items yourself: edit the item and turn on Ask for fingerprint before showing.

Tip: Managed settings can only make Passkey-X stricter. Your organization still can't see your passwords.

Autofill and autosave in desktop programs

The desktop app fills logins into any program (VPN, remote desktop, database tools, games) and offers to save new ones.

In the desktop app open Settings and turn on Autofill and autosave in programs.
Windows: when a program's password box gets the focus, Passkey-X offers Fill (types a saved login) or Save (keeps the new sign-in; you type the password once). Turn the offers off with Offer to fill or save when a program asks for a password.
Every system: click in the sign-in box and press the auto-type shortcut. Pick the login and Passkey-X types it into that same window.

Tip: Typing stops if you switch to another window.

Tip: Choose Never type into web browsers if you use the browser extension for websites.

3. Protect your account

Sign-in security, recovery and security checks.

Turn on two-step verification or a passkey

Stop anyone who learns your login password from signing in.

Open Account security.
Choose Add passkey to sign in with your fingerprint, face or device PIN, or choose Set up authenticator app (such as Google Authenticator or Microsoft Authenticator).
For an authenticator app, scan the QR code and type the 6-digit code to confirm.
Next time you sign in, Passkey-X asks for the passkey or the code.
Then choose Create recovery codes and keep them somewhere safe outside Passkey-X, so a lost phone never locks you out.

Tip: Two-step verification protects your account sign-in. Your vault password still protects the vault itself.

Tip: Use an authenticator app outside Passkey-X, or add your mobile number too. If the only copy of the code is inside Passkey-X, signing out can lock you out.

Lost your phone or authenticator app

Six ways back in when you can't get your two-step code. Your vault stays safe either way.

Sign in with your email and password. On the two-step screen, choose Can't use this? Lost phone or authenticator.
Text me a code: if you added your mobile number, get a code by text message.
Use a recovery code: type one of the 10 codes you saved when you turned on two-step.
Approve from another device: open Passkey-X on your computer, browser or phone where you're still signed in, and choose the number shown on the new screen.
Ask my trusted contacts: call or meet them and read them the 6-digit code on your screen; they type it in Passkey-X to confirm it's you.
Ask my administrator: in an organization, your admin chooses Reset two-step next to your name in Admin console › People › All people. In a family, the family owner opens Shared vaults (with the family vault selected) › Family members and chooses Reset two-step next to your name.
Wait 24 hours: when nothing else works. We email you and alert your signed-in devices; anyone with access to them can cancel it if it wasn't you.
When you're back in, set two-step up again in Account security and save new recovery codes.

Tip: Every way removes your two-step methods and emails you. It never opens your vault: that still needs your vault password.

Tip: Got an email that someone asked to reset your two-step verification and it wasn't you? Open Passkey-X, choose Cancel it, and change your account password.

Forgot your vault password

Unlock with your recovery key, or ask your organisation for help.

On the Unlock screen choose Use recovery key.
Open the recovery key file you downloaded during setup and paste the key.
Choose a new vault password. Your items stay exactly as they were.
If your company turned on organisation recovery, choose Ask my organization for help instead. An administrator verifies it is you and gives you a one-time code.

Tip: Forgot your login password (the one you sign in with)? Choose Forgot login password? on the sign-in screen to get a reset email.

Travel safely with travel mode

Take sensitive vaults off all your devices before crossing a border.

Open Protection › Travel mode.
Tick Safe for travel next to each vault you need on the trip. Everything else will be removed from your devices.
Choose Turn on travel mode. Your other vaults disappear from every device you are signed in on.
After the trip, sign in again and choose Turn off travel mode within 15 minutes. All your vaults come back.

Tip: Part of Personal, Family, Professional, Team, Business and Enterprise.

Tip: Nothing is deleted. Hidden vaults stay safe on our servers, encrypted, until you turn travel mode off.

Check your activity timeline

See every sign-in and every action on your account in one place.

Open Activity timeline.
Sign-ins from a new device or country are highlighted at the top.
Filter by sign-ins, vault, sharing or settings, and export the list as CSV if you need a record.
If something wasn't you, open Account security, sign out other devices and change your passwords.

Run a security check

Find weak, reused and breached passwords and fix the most important first.

Open Security. Checks run on your device; your passwords are never sent anywhere.
Start with anything marked breached or reused.
Use Fix your passwords, one at a time: choose Open change-password page, sign in to the site, then choose Generate new password.
Copy the new password into the site, save it there, then choose Save in Passkey-X. The item leaves the list automatically.

Stay safe outside the vault with Shield (desktop app)

The desktop app warns about passwords you copy in other apps, phishing links, swapped wallet addresses, passwords on sticky notes while you share your screen, and open Wi-Fi.

Install the Passkey-X desktop app for Windows, macOS or Linux and sign in. Shield is on by default.
Copy a password, API key, card number or recovery phrase from an email or chat: a notice offers Save to vault and Clear clipboard. Only you see what was copied.
Copy a link: if it imitates a brand, hides its real address or uses other phishing tricks, you get a red warning before you open it. Check any link yourself in This computer › Shield.
Start sharing your screen: passwords are hidden, and if a sticky note or a Desktop note contains a password you get an urgent warning to hide it.
Press Ctrl+Alt+Shift+L (⌘⌥⇧L on a Mac) any time to wipe the clipboard, lock the vault and hide Passkey-X at once.
Turn each protection on or off in This computer › Settings. Some may be required by your organization.

Tip: Everything is checked on your computer. Nothing you copy, no link, note or network name is uploaded; organizations only see the kind of finding and a count.

Tip: If a copied wallet or bank number is swapped within seconds, don't send any payment and scan your computer for malware.

Report a scam website or email

Report a phishing site or a scam sender. Passkey-X AI checks it right away, and clear scams are blocked for everyone using Passkey-X.

Open Security › Security Center › Report a scam website or email. In the browser extension, open it on the site and choose Report scam.
Choose Website or Email sender and paste the address. Add why you think it's a scam if you like; only the Passkey-X team sees that note.
Choose Report and check with AI. If Passkey-X AI is confident it's a scam, it's blocked for everyone within minutes. If it isn't sure, the Passkey-X team reviews it.
See what happened to each report under My threat reports.

Tip: Well-known sites and mail providers (for example google.com or gmail.com) can only be blocked by the Passkey-X team, so a report can't take down a real site.

Tip: You can send up to 20 reports a day.

Block sites, and ask to unblock one

Block any site on all your devices, import a list as a CSV file, and request an unblock if Passkey-X blocks a site you trust.

Open Settings › Site blocking (the tab), type a site such as youtube.com and choose Block. It also covers www.youtube.com and m.youtube.com.
To block many sites, choose Import CSV and pick a file with one site per line or a column of web addresses (up to 5,000 sites). Export CSV saves your list.
The Passkey-X browser extension then stops those sites in every tab within 5 minutes. The desktop and Android apps mark their links as blocked.
Phishing, scam and malware sites in the Passkey-X threat database are blocked for everyone. If one is wrong, choose Request unblock on the warning page or in the link check and say why; the Passkey-X team reviews every request.
If your organization blocks a site, Ask your IT team to allow it sends the request to your admins.

Tip: Free blocks up to 5 sites; Personal and above block up to 5,000.

Protect your computer in the background (desktop app)

The desktop app keeps working from the tray: it shows the Blocked page instead of blocked and dangerous sites in any browser and checks every browser extension and new program.

Install the Passkey-X desktop app and sign in. It starts with your computer and keeps running in the tray (menu bar on a Mac) even when the vault is locked.
Browser protection (Windows and macOS): when a site in the Passkey-X threat database, your organization's block list or your own blocked sites is opened in Chrome, Edge, Brave, Firefox or another browser, the tab shows the Passkey-X Blocked page instead, with a Request unblock button (your administrator decides about their blocked sites, the Passkey-X team about scams and phishing). Nothing is blocked before you have signed in.
Extensions and programs: a new browser extension is noticed within a minute and a new program within 15 minutes. Harmful ones, ones your organization doesn't allow, and extensions added outside the browser's store raise an alert.
See everything in This computer › Device health, including every extension in every browser profile. Choose Report as harmful if something looks wrong; the Passkey-X team reviews it for everyone.
Turn each protection on or off in This computer › Settings. Your organization may require some of them.

Tip: Lists of sites, extensions and programs stay on your computer. Only hashes are compared with the Passkey-X database, and your organization sees only problems.

Tip: If an extension comes back after you remove it, another program installed it: uninstall that program and run a malware scan.

Get alerts with Breach Watch

Passkey-X re-checks your passwords every week and tells you when one appears in a new breach.

Open Overview and choose Turn on in the Breach Watch card.
The first check runs straight away. After that, Passkey-X checks once a week when you open your vault on this device.
If a password shows up in a new data breach, a red alert appears on Overview. Choose Review and fix to change it.
To stop the checks, choose Turn off in the same card.

Tip: Weekly Breach Watch is part of Personal and up. One-off breach checks in Security are free.

Tip: Your passwords never leave your device. Only the first 5 characters of each password's hash are sent to Have I Been Pwned, the same method used by major browsers.

Change risky passwords without getting locked out

The Rotation assistant walks you through breached, reused, weak and old passwords one at a time.

Open Protection › Fix weak passwords. Unfinished changes come first, then passwords handed over to you, breached, reused, weak and old ones.
Choose Generate new password. It is saved next to your current one as pending; sign-in and autofill keep using the current password.
Copy the current and the new password, choose Change password on site and change it there.
Back in Passkey-X choose It worked. The new password becomes current and the old one goes into the item's history. If the website refused it, choose It didn't work and nothing changes.
Optional: set Change this password every 30–365 days for accounts you want to rotate on a schedule.

Tip: Part of Personal, Family, Professional, Team, Business and Enterprise.

Tip: A pending change also shows on the item itself, with It worked and Discard buttons, on every device.

Recover your vault with trusted contacts

Pick people you trust; a number of them must approve before you can set a new vault password.

Open Protection › Emergency access › Trusted contacts and invite 1 to 5 people by email. They need a Passkey-X account with that email and accept in their own app.
Choose how many must approve (we recommend at least 2) and a waiting period (we recommend 2 days), then choose Turn on. Each contact receives one encrypted piece.
Forgot your vault password? Sign in, then on the unlock screen choose Ask my trusted contacts. Keep that browser: the request can only be finished there.
Your contacts approve in Protection › Emergency access › Trusted contacts after confirming with you by phone. You are emailed as soon as a recovery starts, so you can cancel one you didn't start.
After the waiting period, with enough approvals, set a new vault password. Then set your trusted contacts up again.

Tip: Setting up trusted contacts needs Personal or above; answering a request and recovering never do.

Tip: No contact (and not Vlightsoft) can open your vault: fewer pieces than you chose reveal nothing.

Tip: Compare the key fingerprint shown next to each contact with what they see, in person or by phone.

Catch snooping with vault tripwires

Decoy logins that raise a critical alert the moment anyone opens, copies or fills them. Personal and above.

Add a login nobody has a reason to open, with a tempting name such as "Payroll admin (old)" or "AWS root account", and let the generator fill the password.
Open the login and choose Arm tripwire. Only owners and managers of the vault see this; everyone else sees a normal login.
Don't open, copy or fill it yourself. If anyone does, on the web, desktop or Android, the owners get a critical alert by email and in Admin console › Security › Security alerts within seconds.
In a personal vault, an alert means someone else is using your unlocked vault or a stolen session: lock all devices from Devices and change your passwords.

Tip: The decoy stays end-to-end encrypted; Passkey-X only knows its id. Disarm it any time, even after your plan ends.

Auto-lock and clipboard clearing

Choose when your vault locks itself and how long copied passwords stay on the clipboard.

Open Settings. The two most-used choices, Lock after and Clear clipboard after, are under Quick settings at the top.
For everything else open the Vault & lock tab: choose Lock after (minutes of inactivity), and whether to lock when you switch tabs.
Choose how many seconds a copied password stays on the clipboard before Passkey-X clears it.

Tip: Organisations can set a stricter lock time; you then see who manages it.

Tip: The desktop app always locks when the computer sleeps or the screen locks.

Sign-in risk: spot account takeovers early

Every sign-in gets a 0-100 risk score from the Passkey-X Sign-in Risk model, so a stolen password stands out.

Open Security center › Sign-ins and devices to see your sign-ins, their score and the reasons.
Points: new device 30, new country 20, new network 15, impossible travel 35, many networks in an hour 25, several devices in a day 15, unusual time 10, and 10 more for a new device in a new place.
Medium is 30 or more; high is 60 or more. Don't recognise one? Choose Sign out everywhere else and change your account password.
Organizations see high-risk sign-ins as alerts and in Admin console › Security › Risky sign-ins & incidents (device type and reasons only, never your network or location).

Tip: Your first sign-in on a new account always scores 0.

Tip: Business and Enterprise can sign a high-risk session out automatically within a minute.

5. For teams and companies

Organisations, members, roles and admin tools.

Give new people their vaults automatically (onboarding bundles)

On Business, shared vaults follow the department, team or group a person is in.

Open Admin console › Vaults & sharing › Bundles & guests and choose New bundle.
Pick the shared vaults, View or Edit for each, and Use only where people should not see the passwords.
Under Who gets it, add Everyone, a department, team, group or person, then Save bundle.
When someone joins, moves or leaves (by hand or through SSO/SCIM), their vaults follow. Vaults you shared by hand are never taken away.
New people receive the encrypted vault key from an admin's app: choose Deliver keys when the panel says keys are waiting.

Tip: When someone leaves, use When someone leaves on the same screen to see which shared vaults they could open, then change those passwords.

Onboard a new hire with an Onboarding Vault

Prepare their starting accounts; on first sign-in they change each password with the generator and tick it off.

Open Admin console › People › Joiners & leavers. Choose Mandatory or Optional, the deadline, and whether overdue onboarding pauses access.
Under Onboard a new hire, enter their name and work email, pick a template (or add steps), and set each starting username and password. The generator fills strong ones. Tick the shared vaults they should get when they finish (viewer or editor, optionally use only).
Choose Create onboarding vault. It is encrypted on your device; Passkey-X only sees step titles and progress.
Invite them to the organization with the same email. When they sign in, their Onboarding Vault appears first on the web, desktop and phone.
If the progress list says a key is waiting, choose Deliver now. Use Remind, +7 days or Resume when someone needs a nudge.
Each finished account is saved into their work vault, named after your organization and the person (for example Acme · Priya). It belongs to the organization: admins can open it and it stays when they leave. Their Personal vault stays private.
Until they finish, they see only their onboarding and their work vault. Company, department and team vaults open when the last step is done.

Tip: One work vault per person: onboarding the same person again puts the new accounts into the work vault they already have.

Tip: Save a set of steps as a template (Sales, Engineering…) to reuse it, together with its shared vaults. Templates never contain passwords.

Tip: When someone leaves, open the Offboarding checklist on the same screen.

See every member's security for an audit

One table with each person's vault health, device checks, two-step status and onboarding, ready to export.

Open Admin console › Security › Member security (Business; owners, admins and auditors).
Use the tiles to filter: At risk, Needs attention, Healthy or Not reported. Search by name or email.
Each row shows the vault health score with weak, reused and breached counts, every device used in the last 90 days with its failed checks (no screen lock, rooted, old updates…), two-step and onboarding.
Choose CSV or JSON to export. Each export is recorded in the audit log.

Tip: Scores and checks are computed on each person's own devices. You see counts and yes/no answers, never item names or passwords.

See who used a password, and hand over access when someone leaves

Every item has an access timeline; administrators can hand a leaver's vaults to a successor.

Open an item and choose the activity icon to see who showed, copied, filled in or changed it and when. Vault owners and managers see everyone; others see their own activity.
When someone leaves or changes team, open Admin console › People › Access handover (Business) and choose the person and a successor.
Check the vaults they owned or managed and the passwords they used in the last 90 days, then choose Hand over access.
The successor becomes manager of those vaults (keys are delivered from this device, or by a key holder from Admin console › Vaults & sharing › Bundles & guests) and finds the passwords first in their Rotation assistant.

Tip: Handovers and their rotation progress are listed under Recent handovers and in the audit log.

Set up Passkey-X for your company

Create an organisation, choose Team or Business and invite your people.

Open Plans & billing and choose Change plan.
Choose My team or company, then pick Team (3 to 50 people) or Business (5 to 500 people).
When asked where the plan should go, choose Create a new organisation and give it your company name. Passkey-X creates it for you.
Choose how many people need a seat and continue to secure checkout.
After payment, open Admin console to invite people, set policies and see the audit log.

Tip: Team and Business apply to an organisation, not to your personal vault. Your personal vault stays private even inside a company.

Tip: Administrators can manage access and policies but can never read anyone's personal vault. They can open company vaults they hold a key to, such as shared vaults and the work vaults made during onboarding.

Invite people to your organisation

Add employees to your organisation and give them access to shared vaults.

Switch to your organisation with the workspace picker at the top of the screen.
Open Admin console › People › All people and choose Add people. Or open Manage vaults to invite someone to one specific shared vault.
Each person signs in or creates a free account with that email and accepts.
Using Microsoft Entra ID, Okta or Google? Admin console › Security › Sign-in & SSO lets you add people automatically (Business plan).

Roll out Passkey-X to your team

See who has finished setting up, nudge the rest and keep a record.

Open Admin console › Home › Setup & rollout.
Work through the checklist: invite your people (a CSV spreadsheet works for many at once), then on Business require two-step verification and turn on employee breach checks.
Check Where everyone is. Each person shows as Not started, Signed in, Using the vault or Fully set up, with their next step.
Choose Copy reminder and send it to anyone who has not finished.
Choose Download CSV or Print or save as PDF to keep a record for yourself or your auditors.

Tip: Admins see only setup status and totals. Nobody in your organisation can see another person's passwords.

Block websites for your organization (Threat Center)

Block or allow websites for everyone in your organization, import lists from a CSV file and decide unblock requests.

Open Admin console › Security › Threat Center › Policy.
Add sites to Blocked websites, one per line, or choose Import CSV. Example: youtube.com blocks www.youtube.com and m.youtube.com too. Up to 2,000 sites.
Choose Save policy. Every device with the Passkey-X extension picks it up within 5 minutes, and a blocked site can't be opened, even with Continue.
Allowed websites are never blocked for your organization, even if Passkey-X lists them. Use it for partners and internal tools.
Open Phishing reports to see your people's scam reports and their unblock requests. Allow adds the site to your allowed websites.

Tip: Team plan and up (Family plans block sites for the family in Settings › Site blocking).

Tip: Blocking works in browsers that have the Passkey-X extension. Install it everywhere with Group Policy, Intune or an MDM profile (Threat Center › Deploy).

Use the Admin console

Policies, alerts, access reviews, reports and the audit log.

Home › Needs attention shows what to do now: pending invitations, people without two-step, open alerts and setup steps left.
Security › Policies lets you require two-step verification, set a minimum vault password, control sharing and exports, and more.
Security › Security alerts lists unusual activity such as break-glass requests or many failed actions.
Vaults & sharing › Access requests and Activity & reports › Compliance reports help you prove who can access what (Business plan).
Activity & reports › Audit log keeps a tamper-evident record of every change. You can export it.

Tip: Team plan and up. Policies, SSO and SCIM, onboarding, handover, reviews and reports are Business.

Give the right people the right access

Everyone starts as a Member. Give admin access one person at a time, use limited or custom roles, and turn on admin safeguards.

Open Admin console › People › Roles & admins. You see who is an owner, admin or auditor, and who has a limited role.
Choose Give access, pick the person and the smallest role that does the job: Admin (runs the organization), a limited role such as Helpdesk or Security admin, or a custom role. Limited roles can apply to one department or team, and any access can end automatically.
To build a custom role, choose New role, name it (for example IT Support) and tick only the areas it needs: People, Security, Organization, Billing, Audit or Vaults.
Vaults (Vault manager) lets someone create company vaults, delete the vaults they manage and approve exit requests. Give it for one team to make a team lead: they decide exits for their own people.
Confirm it's you when asked. Every grant is recorded in the audit log and raises an alert.
Remove access you no longer need from the same screen, or export the list for your auditors.

Tip: Admin safeguards (owners only): admins must use two-step verification or a passkey, admin access needs a recent sign-in, only owners give the Admin role, optional second-admin approval, and automatic expiry.

Tip: There is no way to make everyone an admin at once, on purpose: each admin is a target for attackers. Use custom roles for teams that need a little more access.

Set device and behavior policies

Turn on desktop protections for everyone, pause sessions that open too many secrets, limit showing passwords, and allow access only from trusted countries or the desktop app.

Open Admin console › Security › Policies › Devices & behavior.
Desktop security baseline: choose what the desktop app enforces — clipboard shield, hiding passwords while sharing (or also blocking copying), sticky-note warnings, link and download checks, open Wi-Fi warnings.
Behavior guard: set how many secrets may be opened or copied within a few minutes. Above that, admins get a high alert and the member can be asked to sign in again, or be paused until an admin lifts it in Alerts › Paused members. Owners are never paused.
Showing secrets: let people copy but not show passwords, or not show them while their screen is shared. You can also ask for a short reason, which is recorded in the audit log.
Trusted locations and devices: list the countries vault access is allowed from (checked by the server on every request) and optionally require the desktop app.

Tip: Try new policies with a pilot team first using a department or team override in Directory.

Review the audit log and export evidence

See who did what, prove the log was not changed and hand evidence to your auditors.

Open Admin console › Activity & reports › Audit log to see every admin action, share, secret reveal and sign-in event.
Filter by person, vault, action or date.
Choose Verify integrity to check the hash chain: any edited or deleted entry shows up.
Export CSV or JSON for your auditors, or stream events to your SIEM continuously.

Check every computer's security (Controller checks)

A 6 MB background program, no vault and no sign-in, that tells admins which computers need attention. Professional, Team, Business and Enterprise. It is the same program as the Controller.

Open Admin console › Devices › Device agents (for your own computers on Professional: Devices › Desktop Micro Agent) and choose Add computers.
Copy the command for Windows, macOS or Linux and run it on each computer, or deploy it with Intune, Jamf or a login script. It downloads the agent from passkey-x.com, joins with the code and starts with the computer.
Every 6 hours the agent checks disk encryption, firewall, screen lock, automatic updates, admin rights, files with passwords or API keys in plain text, SSH keys without a passphrase, passwords left in browsers and the Passkey-X extension.
Each computer gets a score from 0 to 100 with what to fix. Computers that stop reporting for 3 days are flagged as silent.
Remove a computer here; its agent stops at its next report. On the computer, passkey-x-agent leave uninstalls it.

Tip: Only yes/no answers and counts are sent: never file names, file contents, passwords or browsing. Run passkey-x-agent preview to see exactly what would be sent.

Tip: The full Passkey-X desktop app does all of this and more (Shield, secret sprawl clean-up, the vault). The Micro Agent is for computers where people don't use the vault yet.

Manage company computers with the Controller

Signed device settings, staged Passkey-X updates and remote actions on Business; software, local admin passwords and admin rights on Enterprise.

An owner or organization admin opens Controller › Keys & settings and creates the organization keys (two-step needed). Choose the vault that keeps them; keep it to your IT leads.
In Groups & baselines, create a group (a department, an office or an update ring) and choose its settings: screensaver and screen lock, wallpaper, the message before sign-in, firewall, automatic updates, USB storage, Passkey-X settings and its update channel.
Leave it on Report only first. Computers show what would change (drift); switch to Enforce when it looks right.
In Install pack, pick the group and copy the install command. Run it as administrator, or push it with Intune, Jamf or a login script.
Select computers to lock them, send a message, restart them, put them in lost mode or remove the Passkey-X data. Restarts, wipes and other sensitive actions are signed with your key.
Enterprise: add apps in Software and install or remove them in the background; turn on local admin passwords; approve requests in Admin rights.

Tip: Give your IT team a custom role with Control company computers. Local admin passwords and admin rights need Local admin passwords and admin rights as well.

Tip: A setting Group Policy, Intune or Jamf already manages is left alone and shown as managed elsewhere.

Tip: Every result is signed by the computer and chained to the previous one; Check the chain here (on a computer) shows if a record was changed or is missing.

Your Workspace and company apps

One launch page for your own sites and the apps your organization gives your department and team. Personal tiles on every plan; company apps on Team and up.

Edit a login and turn on Show on my Workspace. Add an image or pick a color, and a section name if you like.
Open Workspace and click a tile: the site opens and Passkey-X fills the login.
Admins choose Publish an app, pick a login in an organization vault and who gets it: everyone, a department, a team, a group or chosen people.
Turn on Give access to add people to the vault use-only, so they can sign in without seeing the password. Otherwise they see Ask for access.

Tip: Tile images are shrunk and encrypted with the item; nobody else sees your personal tiles.

Remote: get help, help someone, share your screen

See and control a computer or Android phone with a 9-digit code, an invite link or one click, and share your screen with many people. The person on the device always decides.

Getting help: open Remote, enter the code you were given (or open the invite link). You see who asks, with their email and organization, and choose Allow viewing only, Allow control, or Decline. Then pick the screen to share.
Helping (needs a Remote seat): choose Get a code and read it out, or Make invite link (optionally for one email address). When the person allows it, their screen opens; click it, then type.
Company devices: the Devices tab lists computers with the Passkey-X app. Choose View or Control; the person accepts, unless unattended access is on for your organization and that Windows computer.
Share my screen: many people can watch. Members join with the link; anyone else needs the code and your approval. Give one of them control from the panel in the corner.
While sharing: the bar on top of every window (desktop app) and the panel show who is connected, with Pause, View only and Stop. The vault locks while someone controls.
Android: Settings › Remote. To let someone tap and type for you, turn on Passkey-X Remote control in Settings › Accessibility.

Tip: Compare the security code on both screens: the same digits mean nobody is in between.

Tip: Administrators set seats, unattended access, outside people, the relay and session limits in Remote › Settings. Every session is in the audit log.

Company groups: several organizations, one report

Bring a parent company and its subsidiaries, regions or brands together for one report and shared storage, while each keeps its own people and vaults.

In the parent organization open Admin console › Company & billing › Company group and choose Create (Business or Enterprise).
In each other organization, an owner copies its Organization ID from the same page and gives it to you.
Choose Add an organization with that ID. If you manage it too it joins at once; otherwise its owners approve the request.
The report shows every organization's plan, seats, members, storage, onboarding, alerts, documents and Trust Index, with totals and a CSV export.
Move storage between organizations, and add group admins from the owners and admins of the group's organizations.

Tip: Group admins never get access to anyone's vaults through the group.

Tip: An organization can leave at any time; storage moved to or from it goes back.

Tip: The parent's API key can read the report: GET /v1/company-group/report.

Insights and the Passkey-X Trust Index

One score for how resilient your organization's access is, with the single points of failure, departure risks and unused access behind it.

Open Admin console › Activity & reports › Trust score (Team plan or higher).
The Trust Index (0-100, grade A-F) combines strong sign-in 30%, no single point of failure 20%, fresh access 20%, onboarding on time 15% and storage health 15%.
Next best actions are ranked by how many points each adds; each opens the page where you fix it.
Single points of failure: shared vaults with items and fewer than two owners or managers.
Departure impact: who would leave the biggest gap, how many shared secrets to rotate and which items only they can open.
Unused access: vault access nobody used in 90 days. Remove it to shrink what a stolen account can reach.

Tip: Insights use counts and names of people only; item names and passwords are never read.

Tip: The score is saved daily so you can see the trend; the API serves it at GET /v1/insights.

Device trust: only safe devices open company vaults

Require a screen lock, disk encryption, system updates, a genuine app and a supported Passkey-X version on every phone and computer.

Open Admin console › Devices › Device rules (Team plan or higher).
Choose what happens when a device falls short: do nothing, warn the person and admins, or (Business and Enterprise) keep the organization's vaults closed on that device.
Pick the requirements and, if you like, minimum app versions stricter than Passkey-X's own.
Member devices lists every phone and computer seen in 90 days with its verdict and what to fix; export it as CSV.

Tip: Unknown answers never count against a device.

Tip: People see exactly what to fix and can choose Check again once they have.

Incidents and playbooks

A checklist for each security situation, so nothing is forgotten under pressure, with a full audit trail.

Open Admin console › Security › Risky sign-ins & incidents and choose New incident, or Open incident next to a risky sign-in.
Pick the playbook: compromised account, lost device, departed employee, phishing click, breach exposure or insider risk.
Work through the steps. Sign out everywhere runs from the checklist; the other steps link to the page that does them.
Resolve the incident when done. The median time to resolve is shown at the top; the API serves incidents at GET /v1/incidents.

Tip: Turn on Automatic response to open a Compromised account incident for every high-risk sign-in.

Tip: Every step, assignment and status change is recorded in the audit log.

Email & SMS: triggers, your own email server and SMS provider

Choose which events send email and text messages, and send them through your own email server and SMS provider.

Organizations: open Admin › Email & SMS. Families: open Settings › Emails. Owners and admins see every section.
Triggers: tick Email and Text for each event, then Save triggers. Invitations, Secure Send, notices and account-recovery emails are always sent.
How your emails are sent shows whether emails go out from Passkey-X (the default, no setup needed) or your own server. Choose Send a test email to me to check that real emails arrive; the result shows on the page within a minute.
Email server (paid plans or the Email add-on): choose SMTP or a service (Resend, SendGrid, Postmark, Mailgun, Brevo, ZeptoMail), enter the details and the password or API key, then Add email server. It then shows as Added, with its steps: Added, Test email sent, Turned on. Choose Edit to change it.
SMTP uses port 465 (SSL/TLS) or 2525 (STARTTLS). Ports 25 and 587 can't be used.
Choose Send a test email to me. Once it arrives, turn on Send our emails through this server.
Keep If our server fails, send from Passkey-X instead on so invitations and alerts still arrive if your server is down.
Text messages: pick Sent, Twilio, Vonage or Plivo, enter the account details and the number or sender name, then Check and save and turn on text alerts. Each person confirms their own phone.

Tip: Passwords and API keys are encrypted when you save them and never shown again.

Tip: Every email, and why one wasn't sent, is in the Email log tab.

Tip: Changes to triggers and the email server are in the audit log.

6. Developers & integrations

REST API, agents for scripts and CI, SSO, SCIM and SIEM.

Connect single sign-on (SAML) and SCIM provisioning

Let people sign in with Okta, Microsoft Entra ID or Google, and add or remove them automatically.

Open Admin console › Security › Sign-in & SSO (Business plan).
Verify your company domain by adding the DNS TXT record shown on the screen.
Paste your identity provider's SAML metadata URL and save. Test sign-in with one account before you require SSO for everyone.
Create a SCIM token and add it, with the SCIM URL, to your identity provider to provision people and groups.
Map each SCIM group to a vault so membership follows your directory. Removing someone revokes their access and flags shared vaults for key rotation.

Tip: SSO signs people in; their separate vault password still protects the vault, so the identity provider can never read vault data.

Use the Passkey-X API with a personal API key

Create a scoped, expiring key with an IP allowlist, try it in the console, then use it in Postman or your script.

Open your account menu (top right) › Developers & API › API keys and choose Create key.
Name it after the script that will use it, choose what it may do (for example Vault items: Read, Change feed: Read) and how long it lasts.
Add the IP addresses it will be used from (Add my address fills in this computer). A leaked key then doesn't work anywhere else.
Copy the key (pxu_…) into your secret manager: it's shown once. Then try GET /v1/me in Developers › Console, or download the Postman collection.
Watch each key's Activity, and revoke a key the moment you don't need it.

Tip: Make a test key for a quick try: it's read-only and expires after one hour.

Tip: You get an email the first time a key is used from a new IP address. If that wasn't you, revoke the key.

Tip: Vault contents stay end-to-end encrypted: the API only ever returns ciphertext.

Connect HR, SIEM and ticketing tools with the Organization API

Automate onboarding, offboarding, alerts and reports with scoped API keys.

Open Admin console › Company & billing › Integrations & API keys and create a key with only the scopes the tool needs (for example members:write or audit:read).
Copy the key once and store it in your tool's secret store. It starts with pxk_.
Call the API with Authorization: Bearer <key>. The full reference, with examples, is at passkey-x.com/api-docs. Its “All endpoints at a glance” table lists every endpoint with the scope it needs.
Revoke a key at any time; every call is recorded in Logs (type: API calls) with the key, the address and the result.

Tip: The API never returns passwords or vault contents. Vault data stays end-to-end encrypted.

Tip: Version 1.7 adds the Controller (controller:read, controller:write) and Remote (remote:read, remote:write): queue scans and updates on computers from your RMM, and create Remote invite links from your helpdesk.

Tip: Limit a key to your servers' IP addresses, and use a one-hour read-only test key while you build.

Give scripts and CI pipelines access with agents

Agents read only the vaults you share with them and decrypt on their own machine.

In the Admin console, open Agents and create an agent for the script or pipeline.
Copy the one-time agent token and store it as a secret in your CI system.
Share the vaults the agent needs with it, as you would with a person.
Run the passkey-x agent command with the token. It downloads ciphertext and decrypts it on that machine only.
Stop the agent to end its access at once. Every read appears in the audit log.

Stream audit events to Splunk, Datadog, Sentinel or Elastic

Send every audit event to your security tools as it happens.

Open Admin console › Company & billing › Integrations & API keys › Audit streaming.
Choose Splunk HEC, Datadog, Microsoft Sentinel, Elastic or a signed webhook, and enter the endpoint details.
Send a test event, then turn streaming on.
Alerts can also go to Slack or Microsoft Teams channels.

7. Plans and billing

Choose, change or cancel a plan.

Choose or change your plan

Pick who the plan is for, choose a plan and pay securely through Paddle.

Open Plans & billing and choose Change plan.
Answer who it is for: Just me, My family or My team or company.
Pick a plan. Switch between monthly and yearly, and between INR and USD, to compare prices.
Confirm where the plan applies. For family and company plans Passkey-X can create the family vault or organisation for you.
Review the summary and choose Continue to secure checkout. You pay on Paddle's secure checkout (Paddle is our reseller); Passkey-X never sees your card.
When you come back, the plan activates within a minute. You see a confirmation on screen.

Tip: Each plan belongs to one vault or organisation. Personal and Professional apply to your personal vault, Family to a family vault, Team and Business to an organisation.

Tip: Only an owner or admin can change a plan.

What each edition unlocks (and the lock icons)

Modules your plan doesn't include show a lock and a Go to paid edition button, on the web, desktop, Android and the browser extension.

Free: the encrypted vault, sign-in codes, the generator, Secure Send, security checks, scam reports and up to 5 blocked sites.
Personal and Family add the rotation assistant, emergency access, trusted contacts, travel mode, Breach Watch, vault tripwires and unlimited blocked sites. Family also lets the family admins block sites for everyone.
Professional adds automations and the Desktop Micro Agent for your own computers.
Team opens the Admin console: people, roles, alerts, the audit log, the Threat Center, Workspace company apps and the computers' security checks.
Business adds the Controller, policies, SSO and SCIM, the directory, onboarding and offboarding, access handover, reviews, reports and integrations. Enterprise (10 to 200,000 people, bought in Plans & billing) adds Controller Enterprise (software, local admin passwords, admin rights), Passkey-X Sign, 2 Remote seats, managed SIEM, device trust and self-hosting. The price per person drops automatically from 100 seats.
Choose Go to paid edition on any locked module: Plans & billing opens on the plan that unlocks it.

Tip: Paid plans you belong to count everywhere: a Family member or a company employee gets the Personal extras on their own vault too.

Tip: Nothing is deleted when a plan ends. Recovery, turning things off and reading your audit log always keep working.

Update your card, change seats or cancel

Manage an existing subscription in the Paddle customer portal.

Switch to the vault or organisation that has the subscription.
Open Plans & billing and choose Manage billing.
In the secure Paddle customer portal you can update your payment method, download invoices or cancel. To change the number of seats, contact support@vlightsoft.com.
Changes appear in Passkey-X within a minute. If you cancel, paid features stay on until the end of the period you paid for.

Email add-on: send notices from Passkey-X

For $2.99 a month (₹249 in India), Passkey-X emails people for you: shared-item notices, password-change reminders and family or organization notices.

Open Settings › Add-ons and choose Add for $2.99 (₹249 in India, or a yearly price with 2 months free). Paddle handles the payment.
Personal: covers you. Family or organization: an owner or admin buys it once and it covers everyone (fair use: 100 emails a day per person).
After you share an item, choose Email notice under the link. The person gets an email that you shared something; you still send the private link yourself.
Owners and admins can send a short notice to a member from Settings › Add-ons. It goes to the member's own account address.
Secure Send also goes up from 20 to 200 emails a day.

Tip: Emails never contain a password, a secret or a link that opens one. Links you type in a note are removed.

Tip: Replies go to your own email address.

Tip: Cancel any time from Manage or cancel; it stays on until the end of the paid period.

Storage: how much you have and what uses it

Each account, family or organization has one storage pool. See what uses it, when it fills up and how to add space.

Open Plans & billing › Storage (organizations: Admin console › Company & billing › Storage) to see the space used and the total.
The total is your plan's amount (Free 0.25 GB, Personal 1 GB, Professional 5 GB, Family 10 GB, Team 1 GB, Business 2 GB and Enterprise 5 GB per paid seat), plus storage packs.
Owners and admins see usage by department, vault and person, the last 90 days and the Runway: the date the pool fills at the current pace.
Cap a vault so one project can't use the whole pool. Uploads that would pass the pool or a cap are stopped with a clear message.
Add space with Storage packs (100 GB each) in Settings › Add-ons.

Tip: Admins get an alert at 80% and 95%.

Tip: Company groups can move free space from one organization to another.

8. Your account

Devices, exports and deleting your account.

Control all your devices

Lock, ring or remove any device, and use your phone as a master key.

Open Devices to see every phone, computer, browser and extension on your account.
Choose Lock on one device, or Lock all my other devices. On a computer you can also lock the screen; on a phone you can make it ring.
Lost a device? Choose Remove. It is signed out at once and erases what Passkey-X kept on it the next time it connects.
In the Android app, turn on Use this phone as my master key. Your phone can then approve new sign-ins with matching numbers and unlock your computers.
Optional: turn on Lock my computers when my phone is away (with Presence on in the phone app), and Require my phone to approve new sign-ins.

Unlock with your phone

Open your vault on a computer or browser without typing the vault password.

Set up your Android phone as your master key (Passkey-X app → Settings → Devices and Micro Agents).
On the unlock screen of the web vault, desktop app or extension, choose Unlock with my phone.
Your phone shows three numbers. Pick the one on your computer's screen. Your account key travels end-to-end encrypted, so Passkey-X never sees it.
Prefer a code? In Devices → This device, turn on Unlock with the 6-digit code from my phone, then type the code from the phone's Sign-in codes tab.

Back up or export your vault

Download an encrypted backup of everything in your vault.

Open Settings › Data and find Encrypted backup.
Choose Export. The file is encrypted with your vault password.
Keep the file somewhere safe. Your organisation may limit exports by policy.

Delete your account

Permanently remove your account and everything in your personal vault.

If you own an organisation or shared vault with other members, make someone else an owner first.
Open Settings › Close account and choose Review account deletion.
Enter your login password, the code from your authenticator app if you use one, and type DELETE MY ACCOUNT.
Deletion is permanent and cannot be undone.

Find any setting

One Settings page: every section in a grouped list with search, and All settings to start.

Open Settings with the gear at the top right (or press Ctrl K and type a section name, such as lock or add-ons). Settings opens on All settings; the search box beside the list finds any setting.
All settings starts with Quick settings (lock time, clipboard clearing and tab-switch lock on this device, and Travel mode), then every section as a card in its group.
Groups: You (Account, Security, Notifications), Vault (Vault & lock, Data, Site blocking), Look & layout (Appearance, Customize interface), Automation & apps (Automation, Signing, Apps & devices), Plan & billing (Plans & billing, Add-ons, Emails, Feature availability) and Close account.
Type in the search box beside the list (for example backup, theme or lock) and press Enter to open the first match.

Tip: Your organization can make lock settings stricter; then you see who manages them.

Tip: Families and organizations: owners and admins find people, roles and policies in the Organization group of the sidebar.

Email log and email templates

See every email Passkey-X sent for you, whether it went out and why not. Owners and admins can add their own note to invitation emails.

Open Settings › Emails. Your email log lists the invitations, Secure Send emails, alerts and notices of the last 90 days. It's free on every plan.
Each email shows Sent, Queued, Retrying or Not sent with the reason in plain words, for example "Email sending isn't set up" or "rejected after 5 tries".
Sent but not arrived? Ask the person to check spam or promotions, or choose Resend on the invitation in Sharing › Invitations › Sent. You can always copy an invitation link and send it yourself.
Owners and admins also see every email members of the family or organization sent.
Paid plans and the Email add-on: under Email templates, pick an email (invitations, onboarding or notices), write a short note and a sign-off, and save. New emails use it straight away.

Tip: Only masked addresses are kept (a•••@example.com); messages and links are erased once an email is sent.

Tip: Template notes are plain text and links are removed, and the security wording and buttons never change, so nobody can turn them into a phishing email.

Tip: Choose Use the standard email to go back.

9. Frequently asked questions

What is the difference between my login password and my vault password?: Your login password signs you in to your account. Your vault password unlocks and encrypts your vault on your device. We never receive your vault password, so we cannot reset it.
Can Passkey-X or my company admin see my passwords?: Not your personal vault. Everything is encrypted on your device, and nobody else, including Passkey-X and your admins, can open your personal vault. Company vaults are different: admins who hold a vault's key (shared vaults they belong to, and the work vault made for you during onboarding) can open it, and it stays with the company if you leave. Passkey-X itself can never read any vault.
Why did checkout say the plan is for a different kind of workspace?: Each plan belongs to one kind of vault: Personal and Professional to your personal vault, Family to a family vault, Team and Business to an organisation. The Change plan steps pick or create the right one for you.
Who can change the plan?: The owner of the vault or organisation, or an organisation admin.
Is there a free trial?: Paid plans include a trial the first time you subscribe: 14 days for Personal, Family and Professional, 21 days for Team and Business.
How do referral invites work?: On Overview, copy your invite link and send it to a friend. When they create a new account with it, their first paid plan starts with a 30-day free trial. When they make their first payment, you get one month of your own plan free, added as credit to your next bill. If you are on Free, the credit waits until you start a paid plan.
Where do vault and organisation invitations show up?: In Sharing › Invitations: Received lists invitations sent to your email, Sent lists the ones you created. Invitation emails never carry vault keys.
Can I cancel or get a refund?: Yes. Cancel any time in Plans & billing → Manage billing and keep access until the end of the paid period. If you are not happy, email support@vlightsoft.com within 30 days of your first payment for a full refund. Details: passkey-x.com/refunds.
How do I get help?: Use Help & guides in the app, visit passkey-x.com/help, email support@vlightsoft.com, or contact us at passkey-x.com/contact.

Need more help? Email support@vlightsoft.com or visit passkey-x.com/contact.