happytails.ai

Passkey browser capability test

Open Passkey browser capability test on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "passkey-browser-capability-test",
  "category": "developer-tools",
  "built": true,
  "requirements": "Pasted JSON up to 100000 characters; CBOR up to 16 levels and 2000 items. Everything runs locally in your browser; the ceremony needs a secure page. Download a JSON report.",
  "implementation": {
    "fields": [
      {
        "key": "runCeremony",
        "label": "Create a test passkey and sign in with it",
        "value": false,
        "type": "checkbox"
      },
      {
        "key": "userVerification",
        "label": "User verification",
        "value": "preferred",
        "type": "select",
        "values": [
          "preferred",
          "required",
          "discouraged"
        ]
      },
      {
        "key": "residentKey",
        "label": "Discoverable credential",
        "value": "preferred",
        "type": "select",
        "values": [
          "preferred",
          "required",
          "discouraged"
        ]
      },
      {
        "key": "rpId",
        "label": "Expected relying party ID (pasted responses)",
        "value": "",
        "type": "text"
      },
      {
        "key": "origin",
        "label": "Expected origin (pasted responses)",
        "value": "",
        "type": "text"
      },
      {
        "key": "challenge",
        "label": "Expected registration challenge, Base64url (pasted responses)",
        "value": "",
        "type": "text"
      },
      {
        "key": "assertionChallenge",
        "label": "Expected sign-in challenge, Base64url (pasted responses)",
        "value": "",
        "type": "text"
      }
    ],
    "registrationFamily": "crypto-formats-signed-envelopes",
    "inputMaxLength": 100000,
    "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_PASSKEY",
    "note": "Runs in your browser. Leave the box empty to test this browser, or paste a WebAuthn response JSON of up to 100000 characters to decode it.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 100000,
      "inputMode": "text",
      "label": "WebAuthn response (optional)",
      "placeholder": "{\"id\":\"...\",\"response\":{\"attestationObject\":\"...\"}}",
      "help": "Leave empty to test this browser, or paste a registration response JSON. Up to 100,000 characters. Review the settings before running.",
      "helpParts": [
        "Leave empty to test this browser, or paste a registration response JSON.",
        "Up to 100,000 characters.",
        "Review the settings before running."
      ],
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Check what passkey features this browser offers, and optionally create a test passkey and sign in with it to see the authenticator flags. You can also paste a WebAuthn response from your own app to decode and verify it.

How to use Passkey browser capability test
  1. Leave the box empty to test this browser, or paste a registration response JSON from your app and enter the values you expect.
  2. To run a real test, tick the option to create a test passkey and choose the verification settings.
  3. Run the tool and follow your browser's passkey prompt if one appears.
  4. Read the capabilities, flags and checks, and remove the test passkey from your password manager if it stays.

Useful next steps

Password generatorJWT decoderBase64 encoder decoder

What it checks

Capabilities come from the browser's PublicKeyCredential methods, including user verifying platform authenticators, conditional mediation and getClientCapabilities where available. Registration and sign-in data are decoded following WebAuthn Level 3 (W3C): CBOR from RFC 8949, COSE keys from RFC 9053, the user present, user verified, backup eligible and backed up flags, the AAGUID and the signature counter.

Signature check

The sign-in signature over the authenticator data and the client data hash is verified with Web Crypto using the public key from registration, for ES256, EdDSA and RS256 credentials. The client data type is always checked. The browser test compares the challenge, origin and relying party ID hash with the values the page used. For pasted responses they are compared with the values you enter, the registration challenge with the registration and the sign-in challenge with the sign-in; an empty field is not compared. When user verification is set to required, the user verified flag must be set in both the registration and the sign-in, as WebAuthn Level 3 sections 7.1 and 7.2 require.

Test passkey

The test passkey uses a random user ID on this site only and is never sent anywhere. Where the browser supports it, the tool asks the passkey provider to forget it afterwards; otherwise remove it yourself. Attestation statements other than none are reported but not verified.