Interactive Passkey Sandbox
Welcome to the passkey testing environment. Here, you can test how registration (signup) and assertion (login) feel in practice. Unlike passwords, passkeys use cryptography to sign a challenge from the server, eliminating phishing risks.
Study Instructions: Try creating a new account first, then log out and log back in using your device's passkey authenticator (e.g. Windows Hello, TouchID, FaceID, or a USB security key).
Create a username and bind it to a credential generated securely by your device's hardware.
Authenticate instantly using your saved passkey. You can trigger a username-less login to let your device locate the correct key, or search for a specific username.
Welcome back, User!
User ID: uuid-string
You are successfully logged in using your Passkey! Your private key remains locked on your physical device, and only the corresponding public key was used for verification.
Show Technical Credential Details
Your Registered Credentials
This device has registered the following passkey credentials for this sandbox instance.
| Credential ID (Truncated) | Counter | Created |
|---|
Usability Questionnaire
Thank you for testing the passkey signup/login flow! To help with our research study, please click the link below to share your experience on our Google Form.
Live Authentication Flow
Watch the network sequence and cryptographic checkpoints update in real-time as you authenticate.
Ready to Test
Enter a username on the left and click Register Passkey (or toggle Demo Mode to simulate it) to see a step-by-step explanation of how authentication occurs!
💡 Security & Usability Insights
- No Passwords: You don't need to create or remember complex characters. Passkeys are stored directly on your device.
- Biometric Privacy: Your fingerprint, face scan, or PIN is processed locally on your device. The website and server never see it.
- Phishing Protection: Passkeys are cryptographically locked to this specific domain (localhost), protecting you from fake websites.
View the exact JSON payloads exchanged under the hood during the WebAuthn ceremony.
// Awaiting registration or authentication...// Awaiting credentials callback...// Awaiting verification result...