Passkeys with advanced security in Arrow

Arrow has created a new approach for managing passkeys that improves security using confidential computing. This approach will also make it possible to securely share passkeys in the future.

This extra layer of security is added to all passkeys created using Arrow after April 24, 2025. You can continue to use any passkeys that you've already saved in Arrow before that date. Any new passkeys you save after that date will be protected with advanced security.

What are passkeys?

What does advanced security for passkeys mean?

Passkeys are always far more secure than the most secure passwords. But passkeys rely on a secret piece of information called a "private key," which is potentially vulnerable to attacks—at least in theory.

Advanced security helps remove this vulnerability by storing the private key in a secure cloud enclave and using confidential computing to access it.

What are cloud enclaves and confidential computing?
More about the private keys and the technology behind passkeys

Why are passkeys with standard security potentially vulnerable?

When you use a password manager to store and log in with passkeys, the standard process usually involves these steps:

1. You create and save the passkey using your password manager app.
2. The password manager encrypts the private key associated with your passkey. Encryption means the information is scrambled so that no one can use it.
3. The password manager stores the encrypted private key on its servers.
4. When you try to access an account using your passkey, the password manager temporarily decrypts or unscrambles the private key so that it can be used to let you log in.

Usually, the password manager decrypts the private key on your device, making it briefly vulnerable to attacks when you log in.

Important: The standard approach to decrypting private keys is still highly secure. To use your passkey, an attacker would need to access your computer or mobile device while the private key is decrypted and then log in to your account at the same time that you're trying to log in.

Learn more about how passkeys work

How are passkeys with advanced security different?

Passkeys with advanced security give your passkeys additional protection by eliminating the step of decrypting your private key on your device. Instead, your private key is decrypted within a secure cloud enclave, meaning that no one—including Arrow, the cloud provider, or attackers—can ever access the private key in its unencrypted form.

More about passkeys and public-key cryptography

Advanced security for passkeys means your passkeys remain safe even if someone gains unauthorized access to your device. This approach gives businesses using Arrow better control and protection from attacks and will allow us to develop secure passkey sharing in the future.

How will advanced security allow for secure passkey sharing?