1 · Verify
Passkey + biometric
WebAuthn user verification unlocks credential-bound PRF key material on the trusted device.
3DVR Control Plane
Recovery Vault
A passkey-protected break-glass layer for root credentials.
Checking this device…
No real credential will be requested until you choose to enroll a recovery passkey.
Device readiness
Can this device protect the vault?
PRF support can only be confirmed during a WebAuthn credential ceremony. The check below never asks for or stores your Bitwarden password.
Safe dry run
Prove the passkey → encryption path first
Enroll a dedicated recovery passkey with no secret attached. Then run an end-to-end self-test using throwaway text. Success proves the authenticator PRF can derive a local AES-256-GCM key without giving 3DVR or an agent the key material.
Portability gate
Prove recovery survives this browser
Export the throwaway ciphertext bundle, move it to another trusted device, import it there, and recover it with the same synced passkey. The bundle is strictly validated and this client accepts only self-test bundles while real-secret storage is disabled.
2 · Encrypt
Local only
The browser encrypts recovery material with authenticated encryption before storage or synchronization.
3 · Store
Ciphertext everywhere
3DVR servers, backups, and agents may handle the encrypted bundle but never plaintext recovery material.
4 · Recover
Owner ceremony
AI may open the flow, but only successful local passkey verification may reveal the value, briefly and masked.
Hard boundary
AI can help without possessing the key
Operator may check backup health, replication state, and guide recovery. It must never receive the master password in chat, logs, memory, telemetry, or task state.
Read the security design →Next
2-of-3 recovery
The target is any two of: trusted passkey/device, offline recovery factor, and trusted-person recovery factor. No single server or agent should ever be enough.