WebAuthn testing bench · runs locally · no server, nothing leaves the browser
…
A passkey is cryptographically tied to this domain. One made here will never work on another origin — that binding is why passkeys cannot be phished.
01 Registration
To store into LastPass, unlock the LastPass extension first — it intercepts the prompt and saves the passkey to the vault.
02 Authentication
03 Prove it
Phishing (wrong domain blocked), Tamper (altered signature fails), Replay (reused login rejected) — the three pillars. Plus Wrong-key (only the matching key verifies) and Verification (presence vs PIN/biometric). Create a passkey first, then run them.
Ledger
| Created | Username | Wallet | Portability | Sign-ins |
|---|
Held in localStorage for testing — credential IDs and metadata only, never private keys. Those stay in the authenticator.
Trace