Frequently Asked Questions

A PennKey is an individual's username and an associated password within the PennKey authentication system. A PennKey is required to authenticate your identity and access many of Penn's online resources. 

University of Pennsylvania faculty, staff, students, and alumni; employees of the University of Pennsylvania Health System; and sponsored guests (individuals with an official business need for accessing restricted Penn resources) are eligible for a PennKey. Some examples of sponsored guests include consultants, volunteers, visiting scholars, and course auditors.

How you get a PennKey depends on your affiliation with the University. For example, the process for incoming students is fully automated. PennKeys for guests and temporary affiliates are initiated by the sponsoring department, center or school. 

They should enter the last four digits of the 9-digit identifier (ID) they received from the University. This ID takes the form xxx-xx-xxxx and is variously referred to as a Student ID, a Federal Taxpayer ID, and a Penn-assigned SSN. Students typically receive this identifier from their admitting program office, while faculty and staff receive it from their business administrator.

Newly admitted students who did not provide a U.S. SSN with their application are also issued a Penn-assigned SSN to use during PennKey registration. 

Your PennKey username can be changed only under the following circumstances:

• A legal name change
• A PennName is deemed offensive to the Penn community
• Reported email harassment or threats that warrant a change

Provided that you meet one of the criteria above, to initiate a request for a PennName change, contact the IT support staff of your school or center. Please note that if your PennKey username changes, so will your username on all other systems that are based on your PennKey username such as your email account name.

If you can't remember your PennKey username, contact the PennKey support group for assistance.

PennKeys generally do not expire but they may become inactive. An active PennKey alone does not grant access to PennKey-protected services. Authorization (access or eligibility to use a service) is determined by the owners of individual services and may change or be terminated if your University affiliation or status changes.

Your PennKey alone doesn't authorize you to use campus computers or resources services. It only proves your identity. Authorization is the service owner's decision. For example, say that you change jobs within Penn. Previously, you had access to departmental financial data via BEN Reports, but that's not part of your new job. You'll still be able to use your PennKey for authorized services like Workday, but you won't be able to access the financial data you previously were authorized to access. 

PennKey Setup Codes are temporary identifiers used to log in to the PennKey Registration application. A Setup Code expires once it's been used or 30 days from the issue date, whichever comes first. It cannot be resused. A Setup Code can be used to (1) register a new PennKey, or (2) reset a PennKey password if you have forgotten it.

You can always get a replacement Setup Code by contacting PennKey Support or visiting a PennKey Administration Station. Note that once you request another Setup Code by any means, the previously requested Setup Code becomes invalid.

"Dictionary" does not simply mean a standard English language dictionary -- it also includes foreign language dictionaries and all kinds of specialized dictionaries that hackers use to crack passwords.

Self-Service Password Reset (SSPR) is Penn’s modern, secure, easy-to-use app for resetting your PennKey password – using only your pre-registered personal (non-Penn) email address and cell phone number.

You will need to reset it -- no one can retrieve a forgotten password for you. If you previously enrolled in SSPR, you can reset your password online instantly. Otherwise, you need to obtain a new Setup Code.

You can reset your password to something that you prefer by using the Self-Service Password Reset (SSPR) if you know your existing PennKey password.

If you believe that your PennKey password has been compromised, contact the Office of Information Security at security@isc.upenn.edu  or by calling 215-898-1000. They can immediately issue a Setup Code against your PennKey that will effectively “freeze” your PennKey until you can obtain a Setup Code to reset your password. If you believe that any criminal activity has taken place or will take place, it is strongly recommended that you contact Penn Public Safety at 511 (on-campus) or 215-573-3333.

If you are having trouble accessing Library resources, visit any Library Circulation Desk and consult with Library staff. Note that not all Penn affiliates are authorized to access Library electronic resources. For more information, visit the Penn Libraries Electronic Resources website. 

Try the Test My PennKey application. If you can authenticate successfully in that application, your PennKey username and password are functioning properly.

If the service uses PennKey authentication, report your access problem to the service or application owner. Your login problem may be specific to that service rather than being a PennKey problem.

Eligible affiliates of the University can visit a PennKey Administration Station on campus with the required photo identification. 

Penn is requiring most people (by affiliation) to enroll in Two-Step Verification in order to protect University information assets and community members’ personal information. Some applications require Two-Step Verification for all users of the service regardless of affiliation. Many of Penn’s peer institutions have already implemented Two-Step, as have banks, financial services providers and companies such as Apple and Google. As more and more of the University’s interactions with its students, faculty, staff, and alumni occur over web-based applications, the need to protect your data from those with criminal intent or a personal grudge is continually increasing.

Password-related security breaches are happening with increasing frequency all over the world. When such breaches occur, users’ passwords and other personal information are then sold to other hackers, or even simply released openly to the world. Considering that users frequently re-use passwords at multiple websites, the security provided by a simple password becomes weaker each year.

In short, relying on passwords to protect our personal and organizational security is not sufficient. We must take steps to improve the security posture of both the University as a whole and you, our individual users.

Consult the Two-Step Verification: Getting Started page for quick instructions on how to enroll. For detailed, step-by-step instructions including screenshots, see Two-Step Verification: Enrollment Instructions.

If you are required to use Two-Step, all Penn web resources that prompt you for PennKey and password will require Two-Step Verification. However, if you confirm "Yes, this is my device" during Duo verification, you will not be prompted again for 60 days if you are using the same browser and device.

If you don’t have access to your primary and back up Two-Step devices, and need to access a PennKey-protected resource, contact PennKey Support.

Duo recommends Security Key products from YubiKey and Feitian. All products recommended below will work on Penn’s Duo implementation.

For YubiKey, use their quiz to answer questions to get a recommendation on the optimal YubiKey product that best suits your needs.

For Feitian, review their product listing for Security Keys to select the best FIDO Security Key product for you.

NOTE: Some classroom PCs at Penn allow a user’s data to remain on the machine after logout. Other classroom PCs are configured to erase that data immediately upon user logout.

• If you’re teaching in a classroom where the PC allows user data to remain after logout (or if you teach using your own computer) you will only need to perform Two-Step Verification on that PC the first time you log in. After that, Two-Step will remain valid for you on that browser for 60 days.
• In many of Penn’s shared classrooms, the room PC is configured to erase each user’s activity immediately after logoff from the machine. In those rooms, Two-Step will be required when lecturers sign in with their PennKey at the start of the class.
• If you’re teaching in a classroom with no Wi-Fi or cellular connectivity, you can still use Two-Step. The Duo app on your device can generate  verification codes without a real-time Wi-Fi or cellular connection.

You can manage your Two-Step account at any time by going to the Duo Device Management Portal: https://upenn.edu/manage-twostep. From here, you can add, rename, or delete devices.

When you click Edit on your phone number's listing, you're editing only the label for your phone number (e.g., a descriptive label such as phone or My Mobile). Use the Add a device option instead (for details, see Two-Step Verification: Configuring a Replacement Phone).

If you’re already enrolled in Two-Step and get a replacement phone, you will need to configure a new Duo Mobile profile for your replacement phone. See Two-Step Verification: Configuring a Replacement Phone for step-by-step instructions.

See Duo documenation: How does changing a phone, number, or SIM card affect Duo Mobile?

No. All currently enrolled users and their devices will continue to work. However, we recommend you consider switching to Duo Mobile and using Duo Push notifications for the most convenient Penn Two-Step experience. If you are currently using another method for Penn Two-Step Verification and would like to continue using it, you may do so.

Users who used Penn's Two-Step Verification prior to November 14, 2023 may see Hardware Token options in their Duo Device Management Portal starting with "HOTP" or "TOTP." These tokens relate to legacy authentication methods, most of which are no longer supported. If you are not actively using any legacy Google Authenticator tokens, it is safe to delete these Hardware Tokens.