How do passkeys and 2FA work?

Harbor supports passkeys and two-factor authentication — use whichever fits how you like to sign in.

Passkeys

A passkey replaces your password entirely. Your device holds a cryptographic key, and signing in is just Face ID, Touch ID, or your device passcode. There’s nothing to type and nothing to phish — a fake sign-in page can’t steal a passkey, because there’s no secret to hand over. Passkeys sync through iCloud Keychain, 1Password, and similar managers, so your other devices can use them too. Add one from your account’s security settings.

Two-factor authentication (TOTP)

If you prefer email and password, add a second factor: a six-digit code from any authenticator app — 1Password, Google Authenticator, Authy, and the rest all work. When you enable 2FA, Harbor gives you recovery codes. Save them somewhere safe (a password manager is perfect); they’re your way in if you ever lose the authenticator.

The rest of the picture

• Sign in with Apple or Google — both supported in the apps.
• Autofill — sign-in plays nicely with 1Password and iCloud Keychain.
• Sessions and devices — see everywhere you’re signed in, and revoke any session or device you don’t recognize.

One distinction worth keeping straight: all of this protects your sign-in. It’s separate from your encryption passphrase, which protects encrypted notes — resetting one never touches the other.