Passkeys and verification codes

#Passkeys

A passkey is a way to sign in without a password. MimiKey can hold your passkeys: when a website asks you to create one, MimiKey generates it and stores it encrypted, and when you sign in, MimiKey does the signing. Passkeys sync to your other devices along with the rest of your vault.

#Create a passkey

After choosing Add a passkey (or similar) in a website's account settings:

• Chrome / Edge: the browser extension asks "Create a passkey with MimiKey?" (用 MimiKey 创建通行密钥？). Click Create (创建).
• Mac: choose MimiKey in the system passkey sheet and click Create passkey (创建通行密钥).
• iPhone: choose MimiKey in the system sheet, unlock, and create it (iOS 17 or later).

Whether the Mac app asks for an extra confirmation depends on the confirmation level: creating a passkey is confirmed again only at Strict.

#Sign in with a passkey

When a site asks for a passkey, MimiKey lists the passkeys saved for that site; choose one to sign in. In the browser extension you can also choose Other options (其他方式) to hand the request to the browser's own flow, for example to use your phone or a security key.

#View your passkeys

In the Mac app sidebar, choose Library > Passkey (资源库 > 通行密钥). Each passkey item shows:

These fields are read-only. The passkey's private key is stored inside the encrypted item and is never shown anywhere.

#Limitations

• Only the ES256 algorithm is supported. If a site doesn't accept it, you'll see a message that the passkey can't be created.
• Passkeys are skipped when you import from another password manager; create new ones for MimiKey on each website.
• The web vault can show and delete passkeys but not create or change them. The Android app doesn't show the Passkey category yet, so don't edit passkey items there.

#Two-factor verification codes

When you turn on two-factor authentication, many websites give you a secret for an authenticator app, usually shown as a QR code. Once you store that secret in MimiKey, MimiKey can generate the codes (typically 6 digits, refreshed every 30 seconds).

#Add a verification code secret

1. On the website, turn on two-factor authentication and choose an authenticator app.
2. When the site shows a QR code, look for an option such as "Can't scan?" or "Enter manually" and copy the secret text. If the site offers a link starting with otpauth://, you can copy that instead.
3. On your Mac or iPhone, open the matching Login item and edit it.
4. Paste the secret or the otpauth:// link into Verification code secret (验证码密钥). On the Mac this field is collapsed by default; click "+ 添加验证码密钥" to show it.
5. Save the item, then enter the current code on the website to finish setting it up.

Supported formats:

#View and copy codes

In the Mac app, open a Login with a verification code secret. The current code and the seconds remaining appear below the secret. Click the code to copy it; the clipboard is cleared after 30 seconds.

#Fill codes automatically

• Mac: when a site asks for a code, choose MimiKey from system AutoFill, then pick the item.
• iPhone: on iOS 18 or later, choose MimiKey's code from system AutoFill.

Only Logins that match the current site and have a verification code secret are listed. See How matching works.

Note Keeping passwords and verification code secrets in the same vault is convenient, but it means both factors depend on MimiKey's protection. For your most important accounts, you may prefer to keep the codes in a separate authenticator app.

#Import and export

When you import from Bitwarden, KeePass or 1Password, verification code secrets on logins come along. Exported Bitwarden JSON, CSV and KeePass XML files include them too. See Import and export.

Website logins in the web vault also have the verification code secret field, so you can view and edit it there. The Android app doesn't show this field yet, so don't edit these items on Android.