Every chapter of computer security begins the same way: a secret, typed somewhere, trusted everywhere. This is the chapter where that stops being true.
Open your ~/.ssh folder. There it is — one file, perhaps guarded by a passphrase you've typed so many times it's become muscle memory rather than a secret. Copy that file, and you are your repositories, your servers, your entire digital estate. No password reset. No second factor. Just a file, sitting quietly, indefinitely trusted.
This has been the arrangement since SSH keys were invented: one secret, trusted forever, guarded by nothing but the discipline of never losing it. It works — until the laptop is stolen, the backup is misconfigured, or the file finds its way into a place it shouldn't be. And when it does, the system has no way of knowing the difference between you and whoever holds the copy.
PhysicalKey proposes a different arrangement — one where identity isn't a file that can be copied, but a fact that must be proven fresh, every time, by the person actually there.
Begin with your phone. Add a physical key when you're ready. The complete work is still being written.
No single layer is enough on its own. Each is a separate, independent proof.
A cryptographic identity generated on your device the moment you begin — never transmitted, never stored anywhere but the phone that made it.
Face ID or Touch ID stands between that identity and anyone who isn't you — a living gate, not a password you could forget or hand over.
A second, separate object with its own identity, carried apart from the phone — so possessing one alone is never enough.
Written honestly: some of this exists today, some is being built, and some is still just an idea.
Identity, Face ID, and the cryptographic handshake with the backend — built and running.
A physical key that pairs over Bluetooth — the cryptography is proven, the hardware is being assembled.
A third layer of proof, not yet designed. Written here because it's the direction, not because it's built.
You revoke that device from another authenticated device, then pair a new phone. Because your private key never left the old phone in the first place, losing it is a replacement problem — not a security incident.
The same answer applies. The key's identity was generated on its own hardware and never leaves it — revoke it, pair a new one, continue.
It replaces the need for it. Traditional 2FA stacks a second copyable secret on top of a first. PhysicalKey's factors are both proof of possessing physical objects — nothing to intercept, nothing to phish.
No. Only public keys and signatures are ever transmitted. Private keys are generated on-device and never leave the hardware that created them.
iOS is in active testing. Android and the physical device are both in progress — see the roadmap above.