🔐 Passkey Playground
Explore WebAuthn passkeys — create, inspect credential structure, and test authentication in your browser
Demo and debug WebAuthn passkeys. Register a credential to see its internal structure (attestation, authenticator data, COSE key), then authenticate to inspect the assertion response. Nothing leaves your browser.
Credential created
Test signing in with a passkey registered on this origin. You must have registered a credential above first — the challenge is serverless so it uses a fixed challenge.
Authentication response
About this tool
Passkeys are the modern replacement for passwords, built on the WebAuthn (Web Authentication) standard. When you create a passkey, your browser or platform authenticator generates a public/private key pair. The private key never leaves your device; the public key and a credential ID are sent to the relying party (the website). On subsequent sign-ins, the site challenges your authenticator to sign a random value with the private key, proving you hold the credential — without ever transmitting a secret.
This playground lets you step through both sides of the protocol. Register a credential and inspect every byte of the attestation response: the RP ID hash, the flags byte (did the user perform verification? was a physical gesture required?), the sign count, the AAGUID identifying your authenticator model, and the COSE public key with its algorithm and curve parameters. Then authenticate to see the assertion: the signed challenge, the returned authenticator data, and the signature itself.
Example: after registration, the decoded authenticator data might show
UP=true UV=true AT=true flags, a sign count of 1, and a
credentialPublicKey with algorithm -7 (ES256) and curve
P-256 — the same structure every FIDO2-compliant key produces.
FAQ
What is the difference between registration and authentication? ›
Registration (also called attestation) creates a new key pair and sends the public key to the website. Authentication (assertion) proves you own the private key by signing a challenge — the private key itself is never revealed. This playground runs both flows so you can compare the response structures side by side.
Why does the authenticator data have a sign count? ›
The sign count is a counter incremented every time the authenticator creates a signature. The relying party can store the last-seen count and detect cloning (if a count ever goes backwards or stays the same). Not all authenticators implement this — some always report zero.
What does the AAGUID tell me? ›
The AAGUID (Authenticator Attestation GUID) is a 16-byte identifier that uniquely identifies the authenticator model — for example, a specific YubiKey firmware version or the platform authenticator built into Chrome on macOS. Many platform authenticators use a zero AAGUID for privacy.
Are credentials stored anywhere? ›
No. The credential is created in your browser and displayed on the page. There is no server-side storage — reloading the page discards everything. To test authentication, you must register a credential in the same session using the same origin.