Guide

How a sealed credential opens a door

A sealed credential opens a door by answering one question: is this person cleared for this door now? The door sends a challenge, the device answers it, and the access point releases the lock on a yes. The building never receives a name, a face or an ID number.

Updated 2 November 2026 · about 2 minute read

A normal building learns who you are by collecting it: a name at the desk, an ID scan, a badge photo, a log that stays on a server long after you leave. Always Encrypted splits those jobs. Your identity is checked once, by us. After that, a door only needs to know whether you are allowed through it.

The rest of this guide follows one door from the first challenge to the release, and explains why the building ends up knowing so little.

What happens, step by step?

1. You verify once. You answer knowledge-based questions and one human auditor validates the result. The record stays on servers we run.
2. Your device receives a packet. It is an encrypted, signed statement that you passed verification and which clearances you hold. It has no name, photo or ID number.
3. You reach a door. The access point sends a one-time challenge.
4. The device answers. A phone, or glasses or a watch running the app, signs the challenge with a private key generated on the device. A ring or pen shows its signed packet.
5. The access point decides. It checks the signature and your clearance for that zone and window, then releases the lock on a yes.

What does the building learn?

Passive keys and active keys: which is safer?

An active key signs a fresh challenge every time, so a copied code opens nothing. A passive key holds only the signed packet, which makes it a bearer credential: whoever wears the ring or carries the pen can tap in until the key is removed or expires. Passive keys trade some safety for convenience. If you pick one, treat it like a door key.

What if a device is lost?

Readers check the signature, the expiry date and a revocation list that syncs about every 5 minutes, so a removed key fails even if the device still holds the packet. Remove the key from your account or the app. The key is revoked and doors stop accepting it. You can renew a key before it expires from the same list. The key checker shows whether a given key is still valid, and it posts the key in a request body rather than in the address, because a passive key is a credential.

Keys last 30 days and can be renewed from the same list; a reader treats an expired key as no key. The same flow carries into wearables. Read about the glasses, the watches and the rings, or go back to exposure levels and countermeasures for what the credential keeps out of view.

Cite this page: Always Encrypted, "How a sealed credential opens a door", https://alwaysencrypted.com/learn/how-a-sealed-credential-opens-a-door/, updated 2 November 2026.