Support & feedback

This is a deliberate design choice. Titanium Passkey’s threat model assumes the Secure Enclave is the only place your private keys should ever exist. Any backup mechanism would, by definition, require the key to leave the hardware it’s pinned to. If you need cross-device syncing, iCloud Keychain already provides that — we made a different trade.

That’s the expected behaviour. Every key is bound to the biometric enrollment that was active when it was created, using the biometryCurrentSet access-control constraint. Changing Face ID or Touch ID enrollment invalidates the keys permanently. The only way back is to re-register each passkey with the relying party.

Check Settings → Passwords → Password Options → Use Passwords and Passkeys from and make sure Titanium Passkey is enabled. iOS will only route passkey requests to providers you’ve explicitly enabled. If it still doesn’t appear, try force-quitting the Settings app and reopening it.

Yes. There is a native macOS build that registers as a system credential provider on Apple silicon and Intel Macs with a Secure Enclave. On a Mac without biometrics (e.g. a Mac mini or a Mac Pro), the app also supports the WebAuthn hybrid transport — scan the QR code that the site presents with your iPhone and the iPhone signs using its own Face ID or Touch ID over Bluetooth. Windows browsers rely on Apple’s system hybrid flow; Titanium Passkey on iOS works as the authenticator on the phone side.

On iOS 18 and macOS 15 and later, Apple’s AuthenticationServices framework exposes a credential transfer API that lets one provider hand credentials off to another on the same device. We’re building support for that — once shipped, you’ll be able to transfer passkeys from a source manager into Titanium Passkey through Settings → Passwords → Transfer Passwords and Passkeys. Existing passkeys whose source provider hasn’t adopted the export side of this API can’t be moved — that’s a WebAuthn spec constraint, not ours.

Use the form above and pick Security concern, or email [email protected] directly. Please don’t disclose publicly until we’ve had a chance to respond. We read every report.