Account Abstraction + Passkeys — Unlock With a Passkey or a Master Password
Every password manager has an ironic flaw: you need a password to protect your passwords. If you forget your master password, you lose everything. If someone guesses it, they get everything.
VaultKeepR addresses this with two technologies: Account Abstraction (ERC-4337) and WebAuthn Passkeys. On a compatible setup you can unlock your vault with your fingerprint or face; a master password path also exists for vaults where no passkey is configured, so the login you get depends on what you set up.
Here's how it works — explained simply.
What Are Passkeys?
Passkeys are the successor to passwords. They're built on the WebAuthn standard, which uses public-key cryptography instead of shared secrets.
When you create a Passkey:
- Your device generates a key pair — a public key and a private key.
- The public key is shared with the service (or stored locally).
- The service receives a signature and a public key, not the private key. Where the private key lives depends on the credential: a hardware-bound credential stays in the secure element of the device that created it, while a synced passkey is backed up by the platform provider (Apple documents end-to-end encryption for iCloud Keychain sync).
To authenticate, your device signs a challenge with the private key. The key itself is not sent to the service, and the browser only signs for the origin that registered the credential, which is what blunts credential phishing. That protects sign-in, not the whole vault: a compromised device or client, or a weak recovery path, can still expose your data.
Where Are Passkeys Stored?
Passkeys are synchronized by your operating system:
| Platform | Sync Method |
|---|---|
| Apple (iOS/macOS) | iCloud Keychain |
| Google (Android/Chrome) | Google Password Manager |
| Windows | Windows Hello |
This means if you create a Passkey on your iPhone, it's automatically available on your Mac, iPad, and any other Apple device signed into the same iCloud account. Same principle applies for Android devices via Google.
What Is Account Abstraction?
In traditional blockchain systems, your "account" is directly tied to a private key. Lose the key, lose the account. There's no recovery mechanism, no "customer support," no reset button.
Account Abstraction (ERC-4337) changes this by turning your account into a smart contract. Instead of being a static key pair, your account becomes programmable code that can define its own rules:
- Who can sign transactions (your Passkey, a backup key, a social recovery guardian)
- When transactions are allowed (time locks, spending limits)
- How recovery works (multiple signers, Shamir fragments, NFC backup)
Think of it as upgrading from a simple padlock (private key) to a smart lock with multiple access methods, logging, and remote management.
How VaultKeepR Combines Both
The public clients are the Chrome and Firefox extensions and the iOS and Android apps, available from Download. Creating a vault does not require an email address or an external wallet such as MetaMask. The passkey and smart-account flow is described in the passkey documentation; available unlock methods depend on the client and authenticator.
VaultKeepR Premium uses Shamir 3-of-5 recovery for the vault encryption key. The five configured channels are the device, remote storage, a trusted contact or QR handoff, a smart contract, and the API. Any three valid fragments can reconstruct the key; losing too many fragments or the recovery identifier can prevent recovery. See the current SDK defaults, channel distribution, and recovery guide. This recovers a vault key, not a hardware passkey or each seed phrase stored in the vault.
The client encrypts vault snapshots before upload. Storage can involve IPFS gateways, pinning services, hosted APIs and S3-compatible backends. These services handle ciphertext, while timing, size, CIDs and on-chain activity may remain observable. IPFS content addressing does not guarantee persistence: retain an independent encrypted backup and test retrieval. The sync documentation and threat model describe those dependencies.
Why This Is More Secure
WebAuthn binds authentication to the relying party. User verification may use a biometric or PIN. A credential may sync through its provider or remain device-bound. A passkey alone does not establish non-exportability or PRF support. See WebAuthn.
An infected device or malicious client remains a threat; no identity scheme guarantees the absence of every failure point.
The PRF Extension — The Secret Ingredient
PRF provides a result tied to a credential secret and an input chosen by the application. Biometrics authorize the operation; they are not the key material. The application receives the result and must protect it in memory. Support and recovery need testing on the target authenticators. The PRF guide covers those limits.
Comparing Authentication Models
Compare login, vault-key generation, recovery and storage separately. A signature, an Argon2id password-derived key and a PRF output are not a universal interchangeable flow. Client documentation should describe what is actually supported.
Getting Started
Setting up passwordless mode in VaultKeepR takes exactly one step:
- Open VaultKeepR
- Tap "Set up with Passkey"
- Authenticate with your fingerprint or face
That's it. Your vault is created, encrypted, and ready. Your Passkey syncs automatically to your other devices. Your EVM identity is derived. Your first NFC backup is one tap away.
Ready to set up? Download VaultKeepR and configure the unlock mode that fits your devices.
Illustrative authentication-only flow, not vault-key generation:
Passkey → "Yes, this is the right user" (authentication only)
