Your master password is encrypted by a random AES-256-GCM data key. Each registered passkey independently wraps that key using an HKDF-SHA-256 key derived from a WebAuthn PRF output released only after device verification. The complete record is authenticated before decryption.

Windows Hello may use your face, fingerprint, or device PIN. Clearing site data or deleting the passkey removes access to the saved copy, so keep the original master password somewhere safe.