Crypto 101 · Security
Passkeys and PINs: Protecting Your Wallet Without Passwords
Abstract
A passkey is a cryptographic credential stored on your device and unlocked with your fingerprint, face or device PIN, so there is no password to phish. A wallet PIN protects use of the app on one device. We explain how each works, what each does and does not protect, and how they fit alongside a recovery phrase.
Keywords: passkeys, PIN, biometrics, WebAuthn, wallet security, Face ID
1. In plain English
A PIN is a short code that unlocks the app on your device, and it works only on that device. A passkey is a stronger replacement for a password. Instead of a secret you type, your phone or computer holds a cryptographic credential that it unlocks with your face, fingerprint or device PIN. Because it is tied to the exact website and never leaves your device, a fake site cannot trick you into handing it over.
Both are convenience and protection layers. Neither one replaces a backup of your keys. If you lose the device, you still need your recovery phrase or keys, or a properly set-up passkey backup, to restore access elsewhere.
2. What each one protects
Table 1. What to expect from each.
| Protection | Protects against | Does not protect against |
|---|---|---|
| Device PIN or Face ID | Someone using your unlocked phone | Losing the phone with no backup |
| Wallet PIN | Someone opening the app on your device | Anyone with your recovery phrase |
| Passkey | Phishing and stolen passwords | Losing all devices with no backup |
| Recovery phrase | Losing your device | Anyone who finds or copies it |
3. Go deeper: how a passkey works
Passkeys follow the W3C Web Authentication standard: your device creates a public and private key pair for each site, keeps the private key, and proves possession by signing a challenge from the site, which checks the signature with the public key [1]. The site never sees a secret it could leak, and the credential works only for the site it was made for, which is what makes it phishing-resistant.
4. Putting it together
- Turn on a device lock and Face ID or fingerprint.
- Add a wallet PIN for everyday use.
- Keep your recovery phrase or keys offline as the real backup [2].
- Never share a PIN, phrase or one-time code with anyone claiming to help you [3].
5. In Scrypt Wallet
Scrypt Wallet supports a PIN, Face ID or fingerprint unlock and passkeys, and lets you choose whether opening the wallet requires the PIN. Signing a transaction keeps its own protection. Read backups and recovery for how the pieces fit together.
References
- World Wide Web Consortium (W3C) (2023). Web Authentication: An API for accessing Public Key Credentials, Level 3. The W3C standard behind passkeys. https://www.w3.org/TR/webauthn-3/
- Palatinus, M., Rusnak, P., Voisine, A., & Bowe, S. (2013). BIP-39: Mnemonic code for generating deterministic keys. Bitcoin Improvement Proposal defining how a list of words encodes the entropy behind a wallet's keys. https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
- U.S. Federal Trade Commission (2023). What To Know About Cryptocurrency and Scams. Consumer guidance: only scammers demand payment in cryptocurrency or guarantee returns; crypto payments are typically not reversible. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-scams
Common questions
Is a passkey better than a password?
It is resistant to phishing because the credential is bound to the site and never typed or sent, but it does not replace a backup of your keys.
Does a PIN protect my funds if my phone is stolen?
A PIN protects using the app on that device; it is not a substitute for keeping your recovery phrase safe and offline.
General education, not financial, tax or legal advice. Figures are schematic. Protocol parameters are cited to primary sources and can change; verify against the linked source before relying on them.