Passkey Lab

Relying party — passkeys created here bind to

…

A passkey is cryptographically tied to this domain. One made here will never work on another origin — that binding is why passkeys cannot be phished.

01 Registration

Create a passkey

Username Display name Authenticator

Shown as “iPhone, iPad or Android device” or “Security key” on Microsoft sign-ins.

Findable by the site (discoverable)

Lets you sign in with no username typed. Microsoft passkeys work this way.

User verification

Proves who is holding the device, not just that someone touched it. Microsoft requires this.

Attestation

Enterprise policy feature — organisations can allow only approved authenticator models. Synced passkeys can’t do this.

To store into LastPass, unlock the LastPass extension first — it intercepts the prompt and saves the passkey to the vault.

02 Authentication

Match

03 Prove it

Each button runs a real attack against the passkey you just made — then shows you exactly what stopped it.

The three pillars

Extra checks

All five need a passkey made on this site to work with — create one in step 1 first.

Ledger

Created	Username	Wallet	Portability	Sign-ins

Import JSON clears the lab's records only — the passkey itself stays on your device until you delete it there.

Held in localStorage for testing — credential IDs and metadata only, never private keys. Those stay in the authenticator.

Trace