All tools

WebAuthn & Passkeys

Sandbox for passkey registration and authentication — configure ceremonies, inspect AuthData, verify attestation/assertion.

Identity & Auth
Privacy: Server-Assisted. This tool calls /api/* for CORS proxies or TLS inspection. Payloads are not retained.

Platform diagnostics for WebAuthn / passkeys in this browser. Registration and authentication require a secure context (HTTPS or localhost).

Checking…
…

What are passkeys?

Passkeys are phishing-resistant credentials based on WebAuthn/FIDO2. Users register a public key with a relying party; later authentications prove possession of the private key held by the authenticator (device, security key, or synced passkey provider).

This workbench walks through registration and authentication options, then verifies attestation/assertion payloads so you can debug RP ID, user verification, and credential formats.

How to use this tool

  1. Configure relying party ID and user details for a registration ceremony.
  2. Create a credential in the browser authenticator and inspect the attested response.
  3. Run an authentication ceremony and verify the assertion against the stored public key material in the session vault.

Frequently asked questions

Where are credentials stored?

Verified credential metadata for this sandbox is kept in sessionStorage on your device — not in a multi-tenant password database.

Why does WebAuthn need a server?

Challenge generation and cryptographic verification of authenticator responses are performed via stbox API helpers so ceremonies match real RP flows, without retaining credentials after the session.