Create and Use Passkeys

First things first!

• To create passkeys, we recommend that you use the Edge/Chrome or Safari browsers.
• A Passkey is not the same as a USB security key.
  • You enter the created Passkey when registering browser-based applications.
  • The security stick looks like a USB stick. You can create Passkeys on this.
• You can create passkeys on multiple devices.
• First, create a passkey on the USB security stick. If you lose or forget a device that has a passkey (such as your smartphone), you can always use your USB security stick.
• Depending on your operating system and browser, the steps for creating passkeys are displayed differently and may differ from the steps shown here.
• For security reasons, the account page account.uni-mainz.de is restricted to passkey usage after setting up your first passkey.
• The following account types are not yet able to use passkeys: Lecturer / guest researcher / research assistants / retired professors / students / PhD students without a contract.

You create new passkeys on each device you want to use for the application. You can create passkeys on the following devices:

• Work desktop at the office
• Business/personal work laptop
• USB security stick (JGU employees receive this from the ZDV)
• Business/personal smartphone

Technical requirements for creating passkeys

Operating systems:

• Windows 10 or higher
• MacOS Ventura
• ChromeOS 109
• iOS 17 or Android 9

Browser version:

• Chrome 109 or higher
• Safari 16 or higher
• Edge 109 or higher
• Firefox 122 or higher

USB security stick:

• FIDO2 support
• All employees will receive an iShieldKey USB-C from Swissbit.

Current Restrictions

Remote desktop connection
You cannot yet use passkeys for browser-based applications that you want to open via a remote desktop connection. This also applies to the internet browser in the adminstration.

Password Managers
Currently, it is not possible to use all password managers, as not all of them have correctly implemented the passkey standard. These password managers are classified as insecure because they do not meet the security requirements.

The following password managers are currently permitted:

• Google Password Manager
• Apple iCloud Keychain
• Samsung Pass

We keep the list of permitted password managers up to date.
If a password manager meets the security requirements, we add it to the list of permitted password managers.

Passkeys in administration

• Please only use passkeys with a browser that is installed directly on your work computer.
• You cannot currently use passkeys with a smartphone in the administration or via internet browser (e.g. Edge Internet or Firefox Internet).

Operating system Windows

Passkeys on a USB security stick

All JGU employees receive this passkey-enabled USB security stick. The ZDV has distributed the USB security sticks to the heads of the faculties, central institutions and administration offices. If you have not yet received one, please contact your head of organization.

Depending on your operating system and browser, the individual steps for creating passkeys are displayed differently and may differ from the steps shown here.

Important notes for the USB security stick

• If you have a desktop computer with a USB-A port, you will also receive a USB-C adapter from the Data Center.
• Always transport the USB security stick without the adapter, otherwise there is a risk that it will break.
• Never leave the USB security stick connected to the laptop during transportation.
• When the USB security stick is connected to your key, do not leave the weight of the key hanging on the USB port.
• To create a passkey on a USB security stick, you need to set a pin for the security stick once. Here are the most important steps.

Create passkeys

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click on + Create Passkey in the upper right corner.
4. Enter a name for the passkey. We recommend that you use the device name. In this case, Swissbit. Confirm the name.
5. A selection is displayed. Select Security Stick (USB Security Stick).
6. Follow the instructions and click Ok.
7. When prompted, insert the USB security stick into the USB port on your computer. The USB security stick lights briefly.
8. To set up the USB security stick once
   You must first create a PIN for the USB security stick. Repeat this and click Ok. You must remember this pin for future use!
9. You will be prompted to tap the USB security stick. It will light up red. Touch the small rectangular metal area on the narrow rear end of the USB stick for half a second. Do not touch the red light! No thumbprint will be taken, only your presence will be requested.
10. The passkey with the name Swissbit will then be displayed in your JGU account.

 

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application. For example, go to arbeitszeit.uni-mainz.de or mail.uni-mainz.de.

1. Click on the login with Passkey option.
2. Click on Security Stick in the selection.
3. When prompted, insert the stick into the USB port and enter the PIN for the USB security stick.
4. Touch the small rectangular metal area on the narrow rear end of the USB stick for half a second. Do not touch the red light! No thumbprint will be taken, only your presence will be requested.
5. You are now logged in.

Passkeys on a laptop/desktop computer

To create passkeys on your laptop/desktop computer (running Windows), you must first turn on Windows Hello. If you have already set up Windows Hello, go directly to Create passkeys.

Windows Hello is a more personal and secure way to log on to your Windows device. Instead of using a password, Windows Hello lets you log in using facial recognition, a thumbprint, or a PIN. In the future, you can also use it to log in to your laptop/desktop computer.

To turn on Windows Hello once

1. In Settings, go to Accounts, and then go to Sign in options.
2. Windows Hello will be offered.
3. You need to set up a PIN first. After that, you can add the option of facial recognition or fingerprint.
4. Select PIN.
5. Enter a PIN that is at least 6 digits long. Please remember this.
6. If you have Windows Hello turned on, you can use this Windows Hello PIN to log in to your laptop or desktop instead of your password.
7. However, you can still select to use your password during Windows login.

If you receive the following error message when activating Windows Hello, click skip for now. Windows Hello will be set up anyway, you can ignore this message.

Very detailed description from Windows: Windows support

Create passkeys

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click on + Create passkey in the upper right corner.
4. Enter a name for the passkey. We recommend that you use the device name. In this case, the name of your laptop/working computer.
5. A selection will be displayed. Select Windows Hello / Windows Device
6. Then enter your PIN for Windows Hello. If you have set up thumbprint or face recognition in Windows Hello, it will appear as an option.
7. The passkey will then be displayed in your JGU account.

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application. For example, go to arbeitszeit.uni-mainz.de or mail.uni-mainz.de.

1. Click the Passkey login option.
2. When prompted, enter your pin for Windows Hello or use the thumbprint or face recognition options if you have them set up.
3. You are now logged in.

Operating system macOS

Passkeys on a USB security stick

You cannot create a passkey on a USB security stick using Safari or Firefox!

• A completely new, not yet set up USB security stick without a PIN cannot be set up using Safari or Firefox and therefore cannot be added as a Passkey. The message The Passkey could not be created. appears.
• Set up the USB security stick on macOS using Chrome or Edge.

Important notes for the USB security stick

• If you have a desktop computer with a USB-A port, you will also receive a USB-C adapter from the Data Center.
• Always transport the USB security stick without the adapter, otherwise there is a risk that it will break.
• Never leave the USB security stick connected to the laptop during transportation.
• When the USB security stick is connected to your key, do not leave the weight of the key hanging on the USB port.
• To create a passkey on a USB security stick, you need to set a pin for the security stick once. Here are the most important steps.

Create passkeys

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click on + Create passkey in the upper right corner.
4. If you want to use Passkey with Touch ID, place your finger on the Touch ID sensor. Otherwise, click Cancel.
5. Select a login method for the USB security stick.
6. Follow the further instructions.
7. The passkey will then be displayed in your JGU account.

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application. For example, go to arbeitszeit.uni-mainz.de or mail.uni-mainz.de.

1. Click on the login option Passkey.
2. Click on Security Stick in the selection.
3. When prompted, insert the stick into the USB port and enter the PIN for the USB security stick.
4. Touch the small rectangular metal area on the narrow rear end of the USB stick for around for at least half a second. Do not touch the red light! No thumbprint will be taken, only your presence will be requested.
5. You are now logged in.

Passkeys on a iMac/MacBook

To create passkeys on your iMac/MacBook, you must first set up iCloud Keychain on your iMac/MacBook.

More information: Apple Support

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click on + Create Passkey in the upper right corner.
4. You will be offered a pre-selection for Touch ID.
5. Select a login method.
   1. Touch ID on your Mac: Place your finger on the Touch ID sensor.
   2. Scan a QR code with your iPhone or iPad: Click on More options.
   3. USB security key: Click on More options.
6. Follow the further instructions.
7. The Passkey will then be displayed in your JGU account.

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application. For example, go to arbeitszeit.uni-mainz.de or mail.uni-mainz.de.

1. Click on the login option Passkey.
2. Use the options you have set up.
3. You are now logged in.

Passkeys on operating system Linux

As Linux cannot store passkeys by default, you must use a smartphone or a USB security key to use passkeys under Linux.

So far, authentication via smartphone only works with the Google Chrome or Chromium browsers. A connection via Bluetooth 5 is also required.

Create passkeys

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click on + Create passkey in the upper right corner.
4. Enter a name for the passkey. In this case, the name of your laptop/working computer.
5. A selection will be displayed.
6. Select a login method.
   • Touch ID on your Mac: Place your finger on the Touch ID sensor.
   • Scan a QR code with your iPhone or iPad: Click on More options.
   • USB security key: Click on More options .
7. Follow the further instructions.
8. The passkey will then be displayed in your JGU account.

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application. For example, go to arbeitszeit.uni-mainz.de or mail.uni-mainz.de.

1. Click the Passkey login option.
2. Use the option if you have set up.
3. You are now logged in.

Passkeys on smartphone (Android with Google services & iOS)

Create passkeys using a Smartphone and a Work Computer/Laptop

Depending on your operating system and browser, the steps for creating passkeys are displayed differently and may differ from the steps shown.

You can also save passkeys on your phone. To log in to the web browser on your computer using the passkey on your phone, Bluetooth must be turned on on both devices.

1. Enable Bluetooth on your devices.
2. Log in with your JGU account at https://account.uni-mainz.de on your work computer/laptop.
3. Click on Passkeys in the left menu bar.
4. Click + Create Passkey in the upper right corner.
5. Enter a name for the passkey. We recommend that you enter the name of the device, e.g. Smartphone Samsung.
6. Then select Smartphone or Tablets.
7. Follow the instructions on your phone.
8. The message will appear on your computer screen: Passkey saved.
9. The passkey will then be displayed in your JGU account.

Create passkeys on your smartphone

1. Log in with your JGU account on your smartphone at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Click + Create Passkey in the upper right corner.
4. You can then enter a name for the passkey. We recommend that you enter the name of your device.
5. Select Smartphone or Tablets.
6. Follow the instructions on your phone.
7. The passkey will be displayed in your JGU account.

Log in with passkeys

After you have successfully created a passkey, you can log in to a browser-based university application (e.g. arbeitszeit.uni-mainz.de or mail.uni-mainz.de).

To log in with a passkey on your smartphone, Bluetooth must be turned on on both devices.

1. Click on the Passkey login option.
2. Under Further options, click on the option Use phone, tablet or security key.
3. A message with a QR code appears. Scan the QR code with your cell phone.
4. A message appears on your smartphone: Log in with a passkey.
5. Follow the instructions on your smartphone. The facial recognition, thumbprint or your pin for the screen lock will be requested.
6. You are logged in.

Delete passkeys

1. Log in with your JGU account at https://account.uni-mainz.de.
2. Click on Passkeys in the left menu bar.
3. Select the passkey you want to delete and click on Remove.

Please Note! You cannot delete the passkey you use for a current login at https://account.uni-mainz.de. You always need at least one passkey to log in to the account website.