Products
UserLock-compatible security keys
Token2 security key are natively supported by UserLock. Starting from version 11, UserLock natively supports Token2 Security keys (second-generation only: the ones listed below) by utilizing the HOTP functionality of these keys.
enrollment guide
Note: Starting with version 3.3, Token2 keys ship with the HID-HOTP feature disabled by default. This feature must be enabled to support UserLock.
Blog
04-04-2026
Understanding FIDO User Verification Modes and the always_uv Setting
Token2 R3.3 and later FIDO2 keys enforce user verification by default with always_uv = true, improving security, though some platforms and apps like Windows 10, macOS, and certain legacy clients may fail to handle this override correctly.
05-03-2026
Introducing TOTPVault — self-hosted TOTP management for teams
Most TOTP apps work by distributing copies of the secret to every person who needs access — fine for personal accounts, but for shared service accounts it means MFA secrets scattered across people's phones with no clean way to revoke access when someone leaves.
21-12-2025
Android, NFC, and the Missing Piece of WebAuthn
For years, Android users have faced a frustrating limitation—Android does not support CTAP2 over NFC. This means no PIN verification and no discoverable credentials (passkeys) when using NFC, and therefore limited to simple U2F-style flows without user verification. That said, there finally seems to be a solution.