KeySigner Start

Security keys for people and teams

Lose a key. Keep your access.

KeySigner makes YubiKeys and other security keys easy to set up, easy to back up and safe to lose. Add a backup key to the same accounts, use either one every day, and when one goes missing, the other still gets you in while you replace it.

Start setup See pricing

Your rule never gets weaker. Losing a key freezes that key. It does not lower how many keys an account needs.

Example accountAny 1 of 2 keys
Your keys
Personal sign-ins Access kept
  • Everyday keyYubiKey 5C NFC Lost, frozen
  • Backup keyYubiKey 5 Nano Signs in
  • Replacement keyNot added yet Add next
1 of 2 keys available. The rule is still met.
Each site checks its own passkey
Still to clean up
2 sites hold the lost key To remove
Email sign-in · Code host sign-in
An illustration of one account after a lost key, not live data.

How it works

From one key to a key you can lose.

Every account is a set of keys plus a rule, from 1 of 1 up to any number you choose. The rest follows from that.

  1. Connect

    Plug in or tap your key. KeySigner sets its PIN and touch policy and reads them back, so the console shows what the key really enforces.

  2. Back up

    Add a second key to the same accounts. Sites that use passkeys need the backup registered there too, and the console lists everything that still depends on one key.

  3. Use

    Sign in to sites, log in to servers and sign Git commits with the tools you already use.

  4. Lose one

    Mark the key lost. New uses with it stop, and you get a list of every account and site it belonged to.

  5. Replace it

    Enroll a new key with the one you still have. The console tracks each account until the old key is gone from all of them.

What it protects

For your own accounts or your team's.

The same keys and rules cover where you sign in, where you deploy and who on your team can act.

Safe accounts and shared Bitcoin wallets are also supported as account kinds.

Losing a key

What a backup key can and cannot do.

Keys are built so their secrets cannot be copied out. That is what makes them safe, and it shapes how backup works.

  • A backup is a second key, not a copy.

    The backup key is a member of the same accounts, with its own secret. A separate recovery rule lets you replace a key even if you lose both.

  • Sites see each key separately.

    After a loss, KeySigner lists every site where the lost key's passkey is still registered. Where a site has no KeySigner integration, you remove it in that site's settings.

  • Recovery needs the recovery rule.

    If too many keys are lost to meet it, KeySigner cannot recover the account for you.

  • Removing a key does not undo what it already did.

    Past signatures stay signed, and a server session that is already open stays open until it ends.

  • A service's own controls stay as configured.

    Its administrators and its own recovery options sit outside your rule. KeySigner does not remove them.

  • Managing access is not the power to act.

    Company sign-in, billing and admin roles decide who runs the console. Only the keys in an account's rule can approve for it.

Plans

Priced per active member.

Choose a plan and set it up yourself. Stripe shows the final amount before you pay.

  • Personal

    For your own accounts, with one or more keys.

    Price

    per month Shown at checkout

    Trial

    No free trial.

    Start with Personal

  • Organization

    Company sign-in

    For teams that share accounts and sign in through their company.

    Price

    per active member per month Shown at checkout

    Trial

    14-day trial starts when your organization is created.

    Start with Organization

Keys and the accounts you add are not charged separately.

Compare plans and fee modes

Start with two keys.

Connect the key you have, add a backup, and see which accounts and sites still depend on a single key.

Start setup Sign in