# Devices and unlocking

Your PIN, passkey unlock, adding a new device and revoking a lost one.

Your keys live on each device you have set up, protected by that device's PIN. This page covers everything about those devices.

> **Security details**
> Each device holds one share of your master key, sealed under a key derived from the PIN with Argon2id. Unlocking opens the device share, fetches the server share after you have signed in, and rebuilds the master key in memory. The server holds nothing derived from the PIN. See [Recovery phrase and shares](https://databeamer.eu/en/docs/account/recovery-phrase).

## Your PIN

The 6-digit PIN unlocks Databeamer on **one device**. Other devices have their own. Change it under **Settings › Security › Change PIN**.

- Enter it wrong too many times and the device is **locked out for now**; try again later. You also receive a **PIN locked** security notification.
- **Forgot your PIN?** on the unlock screen leads to **Remove keys from this device**. Afterwards you add the device again as described below.
- **Stay unlocked on reload** asks for the PIN once per browser session instead of on every reload.

## Passkey unlock

Under **Settings › Security › Passkey unlock**, **Enable passkey** lets you unlock with Touch ID, Face ID, Windows Hello or a security key instead of typing your PIN. It is set per device, and your PIN keeps working alongside it. **Remove passkey** turns it off.

Some passkey providers cannot be used for unlocking; Databeamer will tell you if yours is one of them.

> **Security details**
> The passkey protects the same device share through the WebAuthn PRF extension, which is why providers without PRF support cannot be used. On iOS the Secure Enclave plays the same role behind Face ID. The PIN remains as a second way in.

![Settings › Security with the devices list](https://databeamer.eu/docs-screenshots/en/settings-security.png)

## Adding a new device

Sign in on the new device. The **Unlock Your Account** screen offers two ways to get your keys onto it:

- **Approve from another device**. The new device shows a code. On a device that is already set up, go to **Settings › Security › Device approvals**, choose **Approve** and enter the code. Choose **Deny** if you did not start this. The new device then asks you to choose its own PIN.
- **Use your recovery phrase**. Enter the 24 words and choose **Unlock**. The phrase remains valid afterwards.

> **Security details**
> Device approval is a password-authenticated key exchange over the 6-digit code: the approving device derives a new share of your master key and sends it encrypted to the new device, so the server only relays ciphertext. Requests expire after a few minutes, and both sides write signed audit entries.

![The Device approvals card with a pending device and Approve and Deny buttons](https://databeamer.eu/docs-screenshots/en/device-approval.png)

## Lost or stolen device

Go to **Settings › Security › Devices** on another device. Each device is listed with its type and **Last unlocked** time. Choose **Revoke** and confirm with your PIN. The revoked device can no longer unlock your account, even with its PIN.

If your recovery phrase was stored on that device, **regenerate** it afterwards; see [Recovery phrase](https://databeamer.eu/en/docs/account/recovery-phrase).

If you have lost **every** device, your recovery phrase is the only way back in. Lost that too? See [I have no device and no recovery phrase](https://databeamer.eu/en/docs/account/no-device-no-phrase). For sign-in problems before the unlock screen, see [I cannot sign in](https://databeamer.eu/en/docs/account/cannot-sign-in).

> **Security details**
> Revoking a device refreshes the secret sharing: the remaining devices receive new shares and the revoked device's share no longer combines with the server share. The change is a signed audit entry. Data the device had already decrypted is not affected, which is why a phrase stored on it should be regenerated.