Passkey Debugger
Test and debug WebAuthn/FIDO2 passkey support in your browser
Browser Support
Authenticator Test
Enter a username below to enable Create Credential.
Enter a username above, then create a passkey with your device.
Platform Information
User Agent
-
Platform
-
Security Context
-
Available Authenticators
Understanding Passkeys
How passkeys and WebAuthn work for secure authentication
What are Passkeys?
Passkeys are a passwordless authentication method based on FIDO2/WebAuthn standards. They use public-key cryptography to provide strong, phishing-resistant authentication.
Device Authentication
Passkeys leverage built-in authenticators like Touch ID, Face ID, Windows Hello, or security keys to verify user identity using biometrics or device PINs.
Security Benefits
Unlike passwords, passkeys cannot be phished, stolen in breaches, or reused across sites. Each credential is unique to the specific website and user.
Reading WebAuthn responses
Registration versus authentication
Registration (navigator.credentials.create()) produces an AuthenticatorAttestationResponse containing attestationObject and clientDataJSON. This is where the keypair is created and the public key is handed to your server to store.
Authentication (navigator.credentials.get()) produces an AuthenticatorAssertionResponse with authenticatorData, clientDataJSON, signature, and optionally userHandle. Your server verifies the signature against the public key it stored at registration.
The flags byte
authenticatorData packs several booleans into a single byte. UP (user present) means someone interacted with the authenticator. UV (user verified) means they proved who they were, via biometric or PIN — this is the flag that makes a passkey multi-factor rather than single-factor.
BE and BS (backup eligible, backup state) tell you whether the credential is syncable and whether it's currently backed up. A synced passkey lives in the user's cloud account, which is convenient for recovery and worth knowing about if you have assurance requirements.
Origin binding is the security property
clientDataJSON contains the origin the browser observed, and it's covered by the signature. The authenticator only produces an assertion for the origin the credential was registered against.
This is what makes passkeys phishing-resistant in a way TOTP is not. On a lookalike domain the origin doesn't match, so no assertion is produced at all — the ceremony cannot complete. Your server must still verify the origin and the challenge, since a client that skips those checks throws the guarantee away.
Frequently asked questions
WebAuthn is a lot of ceremony
Challenge generation, attestation, credential storage, and cross-device fallback — Passkey Plus handles the whole lifecycle behind one SDK call.
Free, unlimited users. No credit card required.