You can require a hardware security key (or a phone passkey) in addition to your master password. This is real cryptographic two-factor protection, not just a UI gate: a per-vault secret is mixed into the encryption key and wrapped under each registered key's own hardware secret, so a stolen vault file plus a guessed master password still opens nothing without a registered key physically present.

Turning it on and off

The vault window's Manage menu has a Two-factor (security key) switch — the quick way to turn the second factor on or off. Turning it on walks you through registering your first key and re-encrypts the vault; turning it off removes every registered key (after a confirmation) and returns the vault to password-only.

For finer control — naming a key, or adding a backup without changing the on/off state — Manage → Security keys… lets you add, name, and remove individual keys. Either route, registering your first key turns two-factor on; every additional key is an independent backup, and any one of them can unlock the vault.

No bypass, so register a backup. If you lose every registered key, the saved logins cannot be recovered — that's the entire point of a second factor. Register at least two keys, with a spare kept somewhere safe.

Windows-only for now, via the native Windows WebAuthn API. Without the optional fido2 package installed, this feature simply reports itself unavailable and the vault stays password-only.