Overview

Support WebAuthn Passkeys for quick unlock and as a passkey authenticator.

Feature A: Quick Unlock with Passkey

Replace typing master password with a passkey tap (YubiKey / Face ID / fingerprint).

How it works:

1. First setup: user enters master password + registers a passkey
2. Passkey's PRF output encrypts the master password, stored locally
3. Next time: tap passkey → PRF retrieves encrypted master password → auto-unlock
4. Same security as typing the password, just faster

KDBX format unchanged — fully compatible with KeePass/KeePassXC.

Feature B: Store Website Passkeys

The browser extension acts as a passkey authenticator, storing credentials in KDBX.

Flow:

1. User registers a passkey on a website → extension intercepts navigator.credentials.create()
2. Extension generates keypair, stores private key as a KDBX entry field
3. User logs in → extension intercepts navigator.credentials.get()
4. Extension signs the challenge with stored private key, returns assertion

Technical Details

• WebAuthn PRF extension for key derivation
• KDBX4 KdbxCredentials challenge-response pattern
• Works with Touch ID, Face ID, Windows Hello, YubiKey
• Android PWA + Chrome/Edge desktop

References

• WebAuthn spec
• PRF extension

Priority

Phase 2 — after Phase 1 foundation is complete.