Passkeys / WebAuthn
Phishing-resistant default for sign-in.
Authentication
Every factor you need. Only when you need it.
Passwordless and multi-factor authentication orchestrated by risk: ARKCRON asks for more proof only when device, location, behavior or policy call for it.
Sign-in request · Signals
- Device
- Managed laptop · trusted
- Location
- Usual country
- Behavior
- Matches pattern
- Policy
- Finance apps: phishing-resistant
- Passkey on trusted deviceLow risk
- Passkey + biometric re-checkElevated risk
- Hardware security key, or blockHigh risk
Methods
One platform, every modern factor.
FIDO2 security keys
Hardware-bound keys for highest assurance.
Biometrics
Face and fingerprint, verified on device.
Device-based auth
Keys bound to managed, trusted devices.
Push authentication
Number-matched approvals to resist fatigue attacks.
TOTP
Built-in authenticator codes for legacy sites.
Adaptive MFA
Step-up only when risk increases.
Enterprise SSO
SAML 2.0 and OIDC with your identity provider.
Risk-based policy
Policy as readable code.
Admins describe intent; the risk engine supplies the signals. Each decision is logged with the rule and signals that produced it.
policy: finance-apps
applies_to: { groups: [finance], apps: [erp, banking] }
require:
device: managed_and_compliant
factor: phishing_resistant # passkey or FIDO2
step_up:
when: risk.score >= 0.5
factor: hardware_key
deny:
when: risk.signals contains impossible_travel
log: { siem: true, reason: true }Start with one vault. Keep it for what comes next.
Free for individuals. No card required. Your keys stay on your devices from the first minute.