Authentication
Madhouse Wallet uses multi-factor authentication (MFA) combining email verification and WebAuthn passkeys — no passwords.
Signing In
Login requires two sequential factors:
Enter your account email
Factor 1 — Email OTP: A 6-digit code is sent to your email. Enter it to confirm you control the address.
Factor 2 — Passkey: Authenticate with your registered passkey — Touch ID, Face ID, Windows Hello, or a hardware security key (YubiKey, etc.)
You're in
Both factors must be completed successfully in sequence. A valid passkey alone is not sufficient without the prior email verification step.
How Passkeys Work
A passkey is a cryptographic key pair generated by your device. The private key is stored in your device's secure enclave and never leaves it. The server stores only the public key.
When you authenticate with your passkey:
The server issues a challenge
Your device signs the challenge with your private key (biometric confirmation required)
The server verifies the signature against your stored public key
No password is ever transmitted. Phishing is structurally impossible — the passkey is bound to the domain.
Why MFA?
The email OTP step adds a second, independent factor that cannot be satisfied by passkey compromise alone. Even if a threat actor obtained physical access to an enrolled device, they would also need access to the registered email inbox to complete login.
Adding a Passkey
From Settings → Passkeys, you can register additional passkeys (e.g. a YubiKey as a backup). You can have multiple passkeys on one account.
Using a hardware security key (YubiKey or similar FIDO2 device) is recommended for maximum security — it cannot be compromised by malware on the host device.
Removing a Passkey
Passkeys can be renamed or deleted from Settings → Passkeys. Deleting your last passkey is blocked — you must always have at least one registered.
If you lose access to all your passkeys, account recovery is available via email OTP verification.
Last updated
Was this helpful?