PasskeyLab

WebAuthn testing bench · runs locally · no server, nothing leaves the browser

Relying party — passkeys created here bind to

Passkey testing bench

A passkey is cryptographically tied to this domain. One made here will never work on another origin — that binding is why passkeys cannot be phished.

Origin
Secure context
WebAuthn
Platform auth
Conditional UI

01 Registration

Create a passkey

To store into LastPass, unlock the LastPass extension first — it intercepts the prompt and saves the passkey to the vault.

02 Authentication

Test sign-in

03 Prove it

Show why it's secure

The three pillars
Extra checks

Phishing (wrong domain blocked), Tamper (altered signature fails), Replay (reused login rejected) — the three pillars. Plus Wrong-key (only the matching key verifies) and Verification (presence vs PIN/biometric). Create a passkey first, then run them.

Ledger

Stored on this browser

CreatedUsernameWalletPortabilitySign-ins

Held in localStorage for testing — credential IDs and metadata only, never private keys. Those stay in the authenticator.

Trace