Hello,
as far as I now I could store Passkeys on a Nitrokey. But I can’t find a info how many of them I can store. I think the number for Nitrokey 3 would be most relevant, but are there differences in storage to older Nitrokeys?
Hey @Anigma,
the only older Nitrokey that can store Passkeys is the Nitrokey FIDO2, which supports 10 Passkeys.
The Nitrokey 3 currently is also restricted to 10 Passkeys, but we are currently working on increasing this number.
The background for this is that Passkeys are in fact nothing new, they exists for quite a while within the FIDO2 standard - but mostly known as “discoverable credentials” and/or “Resident Keys”. Now that the “big players” move this topic forward (mostly from a marketing perspective, e.g., Android-support for FIDO2 tokens is still missing) and have given it a fancy new name, more services will support Passkeys and we will therefore also increase the number of available Passkeys that can be stored on the Nitrokey 3.
that’s a great question and I’m glad Nitrokey team is on it. @daringer what’s your estimate on how many keys you will be able to squeeze in?
How can i manage / delete credentials? I’m testing in a dev environment and now my nitrokey is full. The nitrokey app just manages OTP’s… not passkeys.
You could either use nitropy or your web browser to delete some entries.
Hi @daringer,
the NK3 keys I just purchased (in june 2024, i. e. more than half a year after you wrote about your plans to increase this limit) still report a capacity of “about 10” resident keys.
With a limit of only 10 keys it doesn’t make much sense to use the NK3 for passkeys (which need to be “discoverable/resident” keys, right?).
I use them extensively - I also don’t see how having “just” 10 available is reducing the sense to use them - can you explain how you come to this conclusion ? Frankly, I would have trouble listing 10 services using/allowing passkeys, but maybe I didn’t search extensively…
But apart from that: you are right - the fido L1 certification slowed our release process a lot recently. The changeset for a dynamic calculation of available slots is already there + various space improvements - hard to give an ETA for it - but it shouldn’t be too far ™
I just remember someone who said “640 kB RAM should be enough for everyone” 
Seriously: companies and even media (think of heise.de) are promoting passkeys strongly.
To get started 10 entries would certainly be ok, but if everbody starts offering passkeys (some already forcing users to use either MFA or passkeys!) the number of entries required will soon be much higher. I think recent Yubikeys have 100 entries? I won’t reach that, but definitely much more than 10.
I’m not going to use Google’s or Facebook’s authentication services to login to other sites (something other people may not hesitate to do, which limits the number of passkeys they use). And I just moved my main working environment to GNU/Linux, where passkeys are not available in the OS. It would be great to be able to use Nitrokeys instead.
Therefore it’s good to hear that this improvement is still on your todo list
i have been using my Yubikey (having 25 slots) for the past 3 years and i checked that the number of residential/discoverable keys on my yubikey are just 5 . Passkeys have become popular in last 2-3 years but still very few of them use the true discoverable passkey method.
Most websites use non-disscoverable keys and use its as 2fa authentication mwethod… For some reason even google "passkey’ logins don’t use discoverable keys and require you to enter your email id first and authenticates with your security key as non-discoverable.
At first i also felt 10 entries would be less but with the actual passkey adoption very slow , 10 maybe just enough for another 2-3 years. Though more entries would still be a nice to have. Hopefully an update is worked out in meantime.
Unfortunately I am very dependent on some kind of ETA, even if it is just a gut feeling. Depending on how much waiting time there will be I will need to resort to ordering a competing product for my company and if I do not have any idea about what time we are talking about, my good will is not enough to justify refraining from using passkeys. Can you give any rough time estimate?
