· By IMRAN HOSSAIN
Quick answer: Both Bitwarden and Keeper support FIDO2 WebAuthn security keys and platform passkeys, but they behave differently for device sync, recovery, and admin enforcement; set up YubiKey or Touch ID in each app’s Security or Two-step login settings and keep at least one backup authenticator or recovery code. Bitwarden vs Keeper explains broader product differences if you need help choosing.
- Key takeaways: register two FIDO2 keys, keep an offline recovery code, expect device-bound passkeys (Touch ID, Windows Hello) not to sync, and prefer an enterprise policy if admins must centrally enforce keys.
- Bitwarden supports WebAuthn for two-step login and passkeys on web, desktop, Android and iOS; Keeper supports FIDO2 as 2FA and admin-enforced keys for business plans.
- Use YubiKey 5 Series or equivalent USB-C/NFC keys for cross-platform hardware support; platform authenticators are easier but device-limited.
What are passkeys and FIDO2 security keys?
Passkeys are public key credentials created by WebAuthn and FIDO2 to replace passwords; security keys are physical devices that hold those private keys.
Passkeys, standardized by the FIDO Alliance as part of WebAuthn and FIDO2, store a cryptographic key pair: the public key on the server, the private key on the device or hardware token. Platform authenticators such as Apple Touch ID or Windows Hello create passkeys tied to the device and often sync via platform services like iCloud Keychain or Google Passkeys. External hardware security keys, for example YubiKey models, Token2 or Feitian tokens, act as roaming authenticators and can be moved between machines using USB, NFC or Bluetooth. The main trade-off is convenience versus portability: platform passkeys are seamless but device-bound, security keys are portable and phishing resistant but must be carried and backed up. This article covers both approaches for Bitwarden and Keeper and how to plan recovery and backups to avoid lockouts.
How do Bitwarden and Keeper support passkeys and FIDO2?
Both services support FIDO2/WebAuthn, but they differ in where passkeys are stored and how admins can require them.
Bitwarden provides WebAuthn/FIDO2 support for two-step login and a passkey login flow in web, desktop, Android and iOS clients; you register keys in Account Settings under Security or Two-step login. Keeper supports FIDO2 as a two-factor method across devices and offers admin controls to require FIDO2 for vault access in Keeper Enterprise or Business plans. Platform authenticators (Touch ID, Windows Hello) are supported by both apps for unlocking the vault, but those are usually device-bound. For enterprise customers, Keeper’s admin features let you force FIDO2 use and rotate policies; Bitwarden supports organization policies and server-side controls including for self-hosted Bitwarden, which matters if you prefer on-premises control. If your next question is how to set up these keys step by step, see the Bitwarden setup guide and Keeper support documentation in the sections below.
How do I set up a YubiKey with Bitwarden?
You register a YubiKey in Bitwarden by visiting Account Settings, opening Two-step login, choosing WebAuthn or FIDO2, and following the browser prompts to touch your key.
On the Bitwarden web vault, go to your profile, select Account Settings, then Two-step login or Security, choose the FIDO2/WebAuthn option and click Add. Insert the YubiKey, follow the browser prompt in Chrome, Edge or Firefox, and give the credential a recognizable name. On macOS and Windows, the desktop app uses the OS browser stack or native WebAuthn support to register keys. Add a second YubiKey and an authenticator app or recovery code immediately as backups. If you self-host Bitwarden, the same steps apply, but server WebAuthn support requires recent server builds, so check your self-host documentation before enabling. For extra reading on Bitwarden setup steps see the Bitwarden setup guide and expert tips for Bitwarden security to cover master password hardening and local encryption details.
How do I add Touch ID or Windows Hello as passkeys in Bitwarden?
To use Touch ID or Windows Hello, create a passkey or enable device unlocking in the Bitwarden app or web vault when prompted under Security settings.
On iOS, Bitwarden can use Apple Touch ID and iCloud-backed passkey features for autofill and unlocking; enable Face ID or Touch ID in Bitwarden Settings under Security. On Windows 10 or 11, enable Windows Hello in the Bitwarden desktop app or browser extension by registering the platform authenticator when prompted. Remember that platform passkeys tied to Touch ID or Windows Hello generally do not migrate to other devices unless the platform’s cloud sync (iCloud Keychain or Google Passkeys) backs them up. That means if you replace your phone and do not use platform sync you will need to re-register the passkey or use a hardware key backup. For step-by-step issues and extension behavior see the Bitwarden review and the Bitwarden help pages for platform-specific notes.
How do I set up FIDO2 security keys with Keeper?
Keeper registers a FIDO2 security key from the web vault under Settings, Two-step login, or via the Keeper desktop and mobile apps following a similar browser prompt flow.
Log in to the Keeper web vault, open Settings or Account Settings, and navigate to Two-step login. Choose the FIDO2/WebAuthn option and follow prompts to insert and touch your key. Keeper supports multiple keys and lets you name each credential. For teams using Keeper Enterprise, admins can enforce FIDO2 for login and configure policy for recovery and device authorization. Keeper also documents how to pair NFC keys on mobile and how to use Bluetooth keys where supported. After registering your first key, add at least one backup key and a recovery code. If compliance or centralized enforcement matters, consult Keeper Enterprise policy guides to confirm exactly how FIDO2 enforcement will be applied for your plan and environment.
How do passkeys sync across devices in Bitwarden and Keeper?
Platform passkeys may sync via platform services, but hardware FIDO2 credentials typically do not sync and must be re-registered per device unless stored in a manager that explicitly stores WebAuthn credentials.
Apple’s iCloud Keychain and Google Passkeys offer cloud-backed passkey sync for platform authenticators across your devices; Bitwarden and Keeper can rely on those platform services for autofill where supported. Hardware keys like YubiKey or Token2 are roaming authenticators and do not move their private key to another device; you must carry the key or register a second hardware key. Bitwarden’s vault will not import a private key from an external security key, and Keeper does not copy private keys between devices. Some password managers offer their own WebAuthn credential storage for server-backed passkeys, but general practice is to treat passkeys as device-bound unless you explicitly use platform sync or re-register credentials on each device. For migration between managers, plan to re-register with each service and use recovery codes or alternative 2FA during transition; see migration and recovery resources on how to transition to Bitwarden safely.
Which one fits you, and what is the decision framework for choosing between Bitwarden and Keeper for security keys?
Choose Keeper for centralized enterprise enforcement and Bitwarden for flexible self-hosting and low-cost personal options; the decision depends on admin control, self-host needs and budget for hardware keys.
Decision framework: first, decide if you need admin-enforced FIDO2 (Keeper Enterprise makes enforcement straightforward) or self-hosting and auditability (Bitwarden supports self-hosting). Second, if cost matters, Bitwarden’s paid personal plan historically costs about $10 per year, so individuals who want low-cost premium features often pick Bitwarden (Bitwarden pricing page, 2026). Third, if you need platform passkey sync via iCloud Keychain or Google Passkeys, rely on platform features and treat password managers as autofill agents. Profiles: Beginner: choose Bitwarden free with a backup authenticator because it is simple and cheap. Tight budget: Bitwarden Premium for the year offers passkey support and extras. Small team: Keeper Business for admin controls and enforced FIDO2 policies. Advanced or self-hosted: Bitwarden self-host so you control server policies. Who should NOT use this: anyone unwilling to keep a secondary key or recovery code should not enable passwordless-only flows. Example: a solo creator recording weekly episodes who buys one YubiKey at $49 and Bitwarden Premium at $10 per year would spend about $59 first year for both hardware and premium features.
How do Bitwarden and Keeper compare for passkeys and security keys?
Bitwarden and Keeper both support FIDO2, but they differ in pricing options, admin controls, and self-hosting capability.
| Product | Price range | Best for | Key strengths | Main limits |
|---|---|---|---|---|
| Bitwarden | Free to paid personal plans | Individuals, self-hosters | Self-hosting, low-cost premium, WebAuthn support | Admin enforcement is less prescriptive than some enterprise suites |
| Keeper | Paid plans for individuals and teams | Enterprises needing admin FIDO2 enforcement | Granular admin controls, compliance features | Higher cost for enterprise features, fewer self-host options |
What are recovery and fallback options if you lose your keys?
You must create at least one backup method: a second security key, an authenticator app, and/or an offline recovery code stored securely.
Best practices: register at least two FIDO2 keys so losing one does not lock you out, create a long recovery code and print or store it in an offline safe, and enable an alternative 2FA method such as an authenticator app (TOTP) that is separate from your device. For enterprise accounts, enable admin recovery, delegated recovery or a break-glass account. If you use platform passkeys like Touch ID, enable platform-level sync such as iCloud Keychain for Apple devices to restore passkeys to a replacement phone. Note that if you used only a single device-bound passkey with no backups and you lose the device, recovery can be impossible; follow each vendor’s documented recovery flow, and consult Keeper support or Bitwarden help early if recovery steps are unclear. For migration, avoid enabling passwordless-only flows until you have a reliable backup and recovery plan in place; see migration instructions when moving to Bitwarden.
What is a practical checklist to set up FIDO2 keys, passkeys and backups?
Follow a short checklist: register primary and backup keys, create a recovery code, enable an authenticator app, and document your recovery plan in a secure place.
- Buy at least two FIDO2 keys, for example YubiKey 5 Series models or Token2 alternatives.
- Register the primary key in Bitwarden and Keeper under Two-step login or Security settings.
- Register a second hardware key as backup, and name each credential clearly.
- Create and print a recovery code, store it in a safe or secure deposit box.
- Enable an authenticator app on a separate device for TOTP fallback.
- For teams, ensure an admin recovery policy and delegated access is configured in Keeper Enterprise or Bitwarden organization settings.
- Test recovery before relying on passwordless-only flows.
What common mistakes do people make with passkeys and security keys?
The most common mistakes are relying on a single key, treating platform passkeys as portable, and skipping recovery codes or admin policies.
Specific fixes: do not enable passwordless login until you register a backup key and a recovery method. Do not assume platform passkeys like Touch ID will transfer across device families without platform sync; confirm iCloud Keychain or Google Passkeys is enabled. For teams, do not let every user set passwordless only; set a delegated admin or emergency recovery account. If you see registration failures in browsers, check that your browser is updated and supports WebAuthn (Chrome, Edge, Firefox and Safari all support FIDO2 but versions matter). If a hardware key is not recognized, test the key on another device and check for required drivers or firmware updates from the vendor, such as Yubico. Finally, keep records of key names and serials in a secure place for audits.
FAQ
Can I use passkeys instead of a master password in Bitwarden or Keeper?
Direct answer: You can use passkeys or FIDO2 as a second factor or to unlock the app in many cases, but both products still rely on a master password for vault encryption unless you use a passwordless enterprise flow that the vendor explicitly supports; keep a strong master password and backups.
Summary: Bitwarden and Keeper both support FIDO2 and passkeys, with Keeper leaning toward enterprise enforcement and Bitwarden offering flexible self-hosting and low-cost personal plans. Register multiple keys, keep recovery codes, and test recovery paths before relying on passwordless flows. For broader product comparison see the Bitwarden vs Keeper guide and the Bitwarden setup guide for step-by-step instructions. For vendor-specific help consult the official Bitwarden help and Keeper support.