Passkey Login for Group Trip Apps: Sign In Without a Password

The weak link in a shared trip account isn't the app — it's the password#

A group trip account isn't like a throwaway newsletter signup. By the time you're a week into planning, it's holding who owes who across the whole group, where everyone actually is in real time, and the documents and plans you built together. If the password guarding that account is one you've reused somewhere else — and most people's are — a breach of some unrelated site can hand a stranger access to all of it.

That's not a hypothetical. A NordPass survey of 1,727 US adults found 62% "often" or "always" reuse passwords across accounts, and a separate Google/Harris Poll survey of 3,000 US adults found 65% do the same, with 13% using the exact same password everywhere. Attackers don't need to break into your trip app directly — they just need one of your reused passwords to leak somewhere else, then try it where it matters.

Passkeys close that gap by removing the shared secret entirely.

What a passkey actually is#

A passkey is a FIDO Alliance / WebAuthn credential: a cryptographic key pair generated on your device the first time you set it up. The private half never leaves your phone or computer and is unlocked only by your fingerprint, face, or device PIN. The server — in this case, Lumela — only ever stores the public half, which is useless to an attacker on its own.

That design is what makes passkeys phishing-resistant in a way passwords can't be. As Apple explains, there's no secret typed into a login box for a fake site to capture, and a passkey is bound to the specific site it was created for — so even a near-perfect phishing clone of Lumela's login page can't trick your browser into handing over a credential that belongs to the real one. By May 2025, the FIDO Alliance reported that over 15 billion online accounts worldwide already had passkey access — this isn't a niche experiment, it's the direction login is moving across the biggest platforms.

How it works in Lumela today#

Lumela's web app (the version you'd use from a laptop or a browser on any phone) supports passkey login right now, in two places:

• At sign-in. The login screen offers Apple, Google, Telegram and a passkey option side by side — tap the passkey button and your browser asks for your fingerprint, face, or device PIN instead of a password.
• In Account settings. A "Quick Login" toggle, shown automatically if your browser supports WebAuthn, lets you turn passkey sign-in on or off for your account at any time. Turning it off removes the credential; turning it back on walks you through the same device prompt again.

Because this sits on top of the same Firebase-backed sign-in Lumela already uses for Apple, Google and Telegram, signing in with a passkey hands you back into your account exactly the way those do — same trips, same group balances, same conversations, nothing re-synced or re-linked.

Why this matters more for a group than for you alone#

A password breach on a solo app only costs the one person who reused it. On a trip account, a stolen password hands an attacker your group's shared expense ledger, who's paid their share and who hasn't, and — if location sharing is on — where your friends currently are. Credential-stuffing attacks work precisely because people reuse passwords at this scale; a passkey can't be stuffed, because there's no password to try in the first place, and nothing usable leaks even if Lumela's own servers were ever breached, since only the public key sits there.

There's a practical travel angle too: a one-time password sent by SMS can be delayed or simply fail to arrive once you're on a foreign carrier's network, which is exactly the moment you don't want to be locked out of the app holding your trip's money and plans. A passkey, unlocked by the device sitting in your hand, sidesteps that entirely — there's no code to wait for.

Turning it on#

From a laptop or a browser session on your phone:

1. Sign in to Lumela normally (any method).
2. Open Account settings.
3. Find Quick Login and switch it on.
4. Confirm with your device's fingerprint, face, or PIN when prompted.

Next time you're signed out, tap the passkey option on the login screen — no password to type, no code to wait for.

If you're on the iPhone or Android app rather than the browser, you already have the equivalent: biometric quick-login via Face ID, Touch ID, or your phone's own fingerprint/face unlock. The web passkey is the same idea, built for the browser.