How to sign with Face ID, Touch ID or Windows Hello

What happens when your device asks for your face or fingerprint

A passkey is a cryptographic key only you control, created for one website and unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Attest uses it to make your signature; it also unlocks your signing key, the key that decrypts your documents, when its provider supports that (see below). Each time you sign:

1. Your device checks your face, your fingerprint or your PIN, on the device.
2. That check unlocks your passkey, which signs a statement naming the document by its SHA-256 hash and everything you entered on it. A hash is a short code calculated from the file, which changes if one character of the file changes.
3. Attest checks the signature against your passkey's public key before recording it. The passkey must confirm that you were present and verified, which is what the face, fingerprint or PIN prompt does.

Your face or fingerprint never reaches Attest. Apple says Face ID data "doesn't leave your device" and fingerprint data is "never stored on Apple servers". Google says: "Your biometric data is stored on your device and isn't shared with Google." Microsoft says biometric information used in the authentication process "remains on the user's device and isn't transmitted across the network or to the service". Does Face ID or my fingerprint get sent when I sign? explains this in more depth.

Which prompt you'll see on each device

The prompt comes from your device, or from the password manager that keeps your passkey: usually the same face, fingerprint or PIN check you use to unlock the device. What it looks like depends on the device and on where your passkey is saved, as Apple, Google and Microsoft describe it:

Your device	What unlocks your passkey	Where the passkey is usually kept
iPhone	Face ID, Touch ID or your passcode	iCloud Keychain, on all your devices signed in to the same Apple Account
Mac	Touch ID on the Mac or Magic Keyboard, your iPhone or iPad through a QR code or, in Chrome with Google Password Manager, its PIN	iCloud Keychain in Safari; Google Password Manager or iCloud Keychain in Chrome
Android phone	Your fingerprint, your face or your screen lock (on Android, Google Password Manager uses the screen lock, with no separate PIN)	Google Password Manager, synced across your Android devices; on Android 14 or later, another provider you choose
Windows PC	Windows Hello (your face, fingerprint or PIN), your phone through a QR code or, in Chrome with Google Password Manager, its PIN	This PC, a password manager such as Microsoft Password Manager or Google Password Manager, or your phone

In Chrome on a computer, a passkey saved in Google Password Manager has its own PIN. Google's help says: "If this is your first passkey, you'll find a prompt to create a Google Password Manager PIN. This PIN will be requested every time you log in to a website where you have a passkey saved in Google Password Manager." It adds that when you use a passkey, Chrome "may require additional confirmation" by asking for your desktop password or PIN, your fingerprint or your Google Password Manager PIN. An Attest signature uses the passkey the way a sign-in does, so expect the same prompt.

Step-by-step guides for each: iPhone, Mac, Android and Windows.

Set up your passkey, once

If someone sent you a document to sign:

1. Open the email whose subject starts with "Signature requested" and tap Review and sign.
2. Tap Set up with a passkey and confirm with Face ID, Touch ID, Windows Hello or a PIN. With most passkey providers this takes one prompt, and there is no account or password to create.

A passkey set up from a signing link can sign agreements, but it never signs you in to Attest.

If you send documents or sign your own:

1. Sign in at attest.datahubz.com with your email.
2. Open Security (under Settings, in the sidebar or the menu) and click Set up with a passkey.
3. Confirm with Face ID, Touch ID, Windows Hello or a PIN, whichever your device or password manager asks for. Your key is created in your browser.
4. Save the recovery phrase Attest shows you, check I saved my recovery phrase. and click Continue. The page reads Key active and lists your passkey.

A passkey set up while you're signed in also signs you in: on the sign-in page, choose Sign in with a passkey.

Sign with your face, fingerprint or PIN

1. On the signing page, click Open and start signing. Your device may ask for your face, fingerprint or PIN here too, because the same passkey unlocks the key that decrypts the document.
2. Fill in your fields. The first time you click a signature, initials or full name field, type your full name, then pick a handwriting style or draw it, and click Adopt and sign here. As the page says, your passkey makes it binding, not the drawing.
3. When every field is complete, click Sign with your passkey.
4. Confirm with Face ID, Touch ID, Windows Hello or a PIN. The page reads Signed and sealed.

For a document sent without fields, click Open and review the document, check I have reviewed this document., type your full name, then click Sign with your passkey.

Use your phone's Face ID or fingerprint on a computer

A computer with no passkey of its own can use your phone's. At the passkey prompt, choose to use a phone, scan the QR code with the phone and confirm there. Chrome calls this option Use a phone or tablet; in Safari on a Mac, click Other Options, then Passkey from nearby device; in the Windows prompt, choose the iPhone, iPad or Android device option. Apple and Microsoft both say Bluetooth must be on for both devices.

Add your passkey to another device

If your passkey is in a password manager that syncs, such as iCloud Keychain or Google Password Manager, it is already on your other devices signed in to the same account. Otherwise, add one:

1. On the new device, sign in to Attest and open Security.
2. Click Add a passkey on this device (or Set up passkey sign-in on this device).
3. Click Unlock with an existing passkey, for example on your phone, or type your recovery phrase and click Unlock with phrase.

Your key stays the same, so every document stays available on every device. Adding a passkey always takes that unlock: a sign-in from an emailed link alone can't add one. Attest also emails your account each time a passkey is added ("A passkey was added to your Attest account"), so you would know about one you didn't add.

One path needs no unlock: Lost everything? Reset key on the Security page, for someone who has lost every passkey and the recovery phrase. It gives the account a new key and passkey, removes the old passkeys and emails the account that the key was reset. Since a signed-in session is all it takes, whoever controls your mailbox could do it too, so keep your email account secure.

When the prompt doesn't appear or fails

• "The passkey prompt was cancelled or isn't available." Try again, and check that your device has its screen lock, Touch ID or Windows Hello set up.
• "Signing requires a passkey." The browser can't use passkeys. Open the link in a browser that supports them, such as Chrome, Safari or Edge.
• "Signing needs a passkey on this device." Attest has no passkey on record that can sign for you here. As the message says, sign in to Attest with your email, set up passkey sign-in on this device, and come back to the link.
• "First, set up your passkey." Your Attest key has no passkey that can sign yet, for example because you set it up with a recovery phrase only. If you aren't signed in, click the Sign in as button that shows your email address; then type your recovery phrase and click Unlock and create my passkey, or click Use a passkey on another device instead.
• Windows 11 asks for consent. From version 24H2, Windows asks before an app can use passkeys. If you declined for your browser, allow it again in Settings, under Privacy & security, then Passkey access.
• Attest asks for your recovery phrase. Some passkey providers can sign but can't unlock your key. If you set up from a signing link with one of them, Attest also shows you a recovery phrase to save; from then on it asks for the phrase to open a document, and you still sign with your passkey.

Why approving on your device makes stronger evidence

A click on an emailed link records that someone opened it. A passkey signature records more: it was made by a passkey registered to your email address, after your device confirmed you were present and verified, over the exact document and your entries. Anyone can re-check it with any WebAuthn library, from the evidence inside the signed copy, and each signature is anchored on Horizen, a public blockchain. Passkeys for signing documents, explained covers the mechanism.