How it works

Biometric login allows users to authenticate using a biometric credential (fingerprint, face scan, pin or other secure token) without entering a password. Keeper treats these credentials as cryptographic tokens tied to the user.

1. Credential Creation (Registration)

• A biometric credential is generated locally on the user’s device.

  • This creates a public/private key pair.

  • The private key is stored securely on the device and never leaves the device.

• The public key

2. Authentication (Login)

• When logging in with biometrics, the device signs a cryptographic challenge using the private key.

• This signed challenge (token/assertion) is sent to Keeper.

• Keeper validates the signature using the previously registered public key.

• If validation succeeds:

3. Key Principles

• Zero-Knowledge Security – Keeper never receives biometric data or the private key; it only stores the public key.

• Device-Bound Credentials – The credential is tied to the device that created it.

• Password-less Login – Once registered, the credential can replace the master password or any default 2fa.

• Fallback Methods – Users can still use passwords or other 2FA methods if biometric login fails.

Requirements

Power Commander supports Biometric login with Windows Hello only.

Prerequisites:

1. Needs windows 11 or higher

2. PowerCommander version 1.0.7

Supported Commands

This is list of commands supported

Register Biometric Command

This command creates a new passkey with currently logged in user's email. this passkey will be used for authenticating user when they want to login once we register biometric login on a device.

To use this command, you have to be logged in on CLI.

Note:

1. After executing this command, user has to register the device with Keeper to use biometric as default login method.

2. Persistent login takes precedence over biometric login, so if the device has persistent login enabled, biometric credentials are not required during login.

Execution:

Support: This Command supports Windows Hello only.

Flags:

PassThru : this flag will prevent printing of credential ID and such details from printing, when set to true this prints the details, else details are not printed.

Examples

With PassThru flag

Without PassThru flag

Show Credential Command

This command shows all the credentials which have been registered to the given account, along with the authenticator type, credential ID, date created and last used date

To use this command, you have to be logged in on CLI

Execution:

Flags

IncludeDisabled - This will show the details of credentials which are used earlier but are no longer active along with active ones

Example

Verify Credential Command

This command will be used to authenticate your session with credential stored. This same functionality will be used when we are trying to login using biometrics.

Execution:

Flags:

Purpose - This can be either login or reauth . This tells the server whether we are trying to check credential for logging in or to verify whether we are logged in.

PassThru - This will decide whether we are showing the command output related to credential ID etc . by default this is false, so we won't be seeing any such output details.

Sample Output

Unregister Credential Command

This command will be used to deactivate biometric credential from Keeper, meaning the Keeper platform will stop accepting the given cryptographic credential for logging in the user

Execution:

Flags :

CredentialId - this is the credential ID of the credential to be deactivated. if nothing is given then all biometric passkeys will be disabled

PassThru - This is the filter for result, this is by default false, so no output related to technicalities is returned to user when executing this command, but if this flag is given, then user can see the details of credential deleted

Example output :

Overview

A version of Keeper Commander is developed in .Net with a PowerShell module. This is published to the PowerShell Gallery as the PowerCommander module. This document provides instructions for installing and using this PowerShell Module.

PowerShell CLI

Keeper's PowerShell command-line tool (PowerCommander) provides basic vault access and administrative functions.

PowerShell module for Keeper Commander is available on the PowerShell Gallery:

PowerShell Gallery Install

To install PowerCommander from PowerShell Gallery:

GitHub Repository

To run the PowerCommander module from the source, refer to the following GitHub Link:

Installation Troubleshooting

Set Execution Policy Permissions

If you are unable to run PowerCommander commands, you may need to set the Execution Policy. To check this, run the following command:

Your output would be similar to this:

If the Scope for your installation is Undefined or Restricted, set it to Unrestricted with the following command:

Note: The above command sets the CurrentUser scope

Logging in with Biometric Authentication

If biometric authentication is configured on your device, you can use Windows Hello to log in to Keeper Commander. This allows you to bypass both the Master Password and two-factor authentication (2FA) for a faster, secure login experience.

Register Biometric Authentication

First, login to Keeper Commander with your Master Password (or SSO), then register biometric authentication:

Biometric authentication prompt (fingerprint or Face ID) will be displayed.

With successful fingerprint or faceID authentication the registration will be completed:

Device Registration

To use biometric authentication as your default login method, you must register your device

PowerCommander Commands

Login Commands

Biometric Login Commands

Record Commands

Sharing Cmdlets

Enterprise Cmdlets

Secret Manager Cmdlets

BreachWatch Commands

Biometric Login Support Commands

Additional Commands

Not all capabilities of Keeper Commander (Python) have been added to the PowerShell module. We add them on request by customers. If you have requests for our engineering team, please email [email protected].

Examples

Connect To Keeper Account

List the content of Keeper folder

• f - folder

• r - record

• S - shared

• A - file attachments

Show Two Factor Code for all records in the current Keeper folder

Show Two Factor Code for all records in the Vault.

where

• kr is alias for Get-KeeperRecord

• 2fa is alias for Show-TwoFactorCode

Copy record password to clipboard

where

• contro is a substring of the record title. See last entry of kdir output in example #2

• kcc is alias for Copy-KeeperToClipboard

or

'ktY3jEBqwFDi9UYZSxmIpw' is the Record UID of the same record

Add/Modify Keeper record

creates a legacy record in Keeper

creates a record of login type in Keeper

generates a new password for existing record

Pre-defined fields supported by both legacy and typed records

• login Login

• password Password

• url Website Address

Copy owned record to folder

copies all records in the current Keeper folder to the folder with name 'Shared Folder'

List all enterprise users

Create a new Managed Company

Switch to a new Managed Company