# Passkey browser capability test - Human page: https://happytails.ai/en/developer-tools/passkey-browser-capability-test/ - Markdown: https://happytails.ai/en/developer-tools/passkey-browser-capability-test.md - Structured JSON: https://happytails.ai/agents/en/developer-tools/passkey-browser-capability-test/index.json - Visibility: public ## Tool capabilities | Property | Value | | --- | --- | | Tool ID | `passkey-browser-capability-test` | | Category | developer-tools | | Implementation | Registered implementation. Registration alone is not a production-quality guarantee. | | Browser execution | Use the visible action or interactive controls. | | Browser processing | Browser; see tool notes for network behavior. | | HTTP API | Not callable through HTTP. | | Browser-agent interface | run_current_tool | ### Implementation notes Runs in your browser. Leave the box empty to test this browser, or paste a WebAuthn response JSON of up to 100000 characters to decode it. ### Inputs and settings Text input: WebAuthn response (optional). Example or placeholder shown in the interface (not a validated fixture): ```text {"id":"...","response":{"attestationObject":"..."}} ``` Leave empty to test this browser, or paste a registration response JSON. Up to 100,000 characters. Review the settings before running. | Setting | Meaning | Control type | Default | Constraints | | --- | --- | --- | --- | --- | | `runCeremony` | Create a test passkey and sign in with it | checkbox | false | | | `userVerification` | User verification | select | "preferred" | Allowed: preferred, required, discouraged | | `residentKey` | Discoverable credential | select | "preferred" | Allowed: preferred, required, discouraged | | `rpId` | Expected relying party ID (pasted responses) | text | "" | | | `origin` | Expected origin (pasted responses) | text | "" | | | `challenge` | Expected registration challenge, Base64url (pasted responses) | text | "" | | | `assertionChallenge` | Expected sign-in challenge, Base64url (pasted responses) | text | "" | | ### Browser-agent workflow 1. Open the human page in a browser that supports WebMCP. 2. Discover the interface exposed by that page; use its actual schema. 3. Select files on the page first when the tool requires files. 4. Call `run_current_tool` with valid input and settings. 5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links. Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution. ### Planning specification Pasted JSON up to 100000 characters; CBOR up to 16 levels and 2000 items. Everything runs locally in your browser; the ceremony needs a secure page. Download a JSON report. This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support. ### Complete machine-readable capability record ```json { "id": "passkey-browser-capability-test", "category": "developer-tools", "built": true, "requirements": "Pasted JSON up to 100000 characters; CBOR up to 16 levels and 2000 items. Everything runs locally in your browser; the ceremony needs a secure page. Download a JSON report.", "implementation": { "fields": [ { "key": "runCeremony", "label": "Create a test passkey and sign in with it", "value": false, "type": "checkbox" }, { "key": "userVerification", "label": "User verification", "value": "preferred", "type": "select", "values": [ "preferred", "required", "discouraged" ] }, { "key": "residentKey", "label": "Discoverable credential", "value": "preferred", "type": "select", "values": [ "preferred", "required", "discouraged" ] }, { "key": "rpId", "label": "Expected relying party ID (pasted responses)", "value": "", "type": "text" }, { "key": "origin", "label": "Expected origin (pasted responses)", "value": "", "type": "text" }, { "key": "challenge", "label": "Expected registration challenge, Base64url (pasted responses)", "value": "", "type": "text" }, { "key": "assertionChallenge", "label": "Expected sign-in challenge, Base64url (pasted responses)", "value": "", "type": "text" } ], "registrationFamily": "crypto-formats-signed-envelopes", "inputMaxLength": 100000, "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_PASSKEY", "note": "Runs in your browser. Leave the box empty to test this browser, or paste a WebAuthn response JSON of up to 100000 characters to decode it.", "experience": { "automatic": false, "single": false, "inputMaxLength": 100000, "inputMode": "text", "label": "WebAuthn response (optional)", "placeholder": "{\"id\":\"...\",\"response\":{\"attestationObject\":\"...\"}}", "help": "Leave empty to test this browser, or paste a registration response JSON. Up to 100,000 characters. Review the settings before running.", "action": null }, "mode": "explicit", "interactive": false }, "execution": "Browser interface", "api": null, "browser_agent": { "supported": true, "name": "run_current_tool", "discovery": "WebMCP on the human page in a supporting browser", "verification": "See audit/API-AUDIT.md; availability is not verification" } } ``` ## Page guide Check what passkey features this browser offers, and optionally create a test passkey and sign in with it to see the authenticator flags. You can also paste a WebAuthn response from your own app to decode and verify it. How can we improve this tool? Report a problem or share an idea. Please leave out private information. Your message and the tool name go to our team via PostHog. ### How to use Passkey browser capability test 1. Leave the box empty to test this browser, or paste a registration response JSON from your app and enter the values you expect. 2. To run a real test, tick the option to create a test passkey and choose the verification settings. 3. Run the tool and follow your browser's passkey prompt if one appears. 4. Read the capabilities, flags and checks, and remove the test passkey from your password manager if it stays. ## Useful next steps - [Password generator](https://happytails.ai/en/privacy-tools/password-generator/) ([Markdown](https://happytails.ai/en/privacy-tools/password-generator.md)) - [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md)) - [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md)) ## What it checks Capabilities come from the browser's PublicKeyCredential methods, including user verifying platform authenticators, conditional mediation and getClientCapabilities where available. Registration and sign-in data are decoded following WebAuthn Level 3 (W3C): CBOR from RFC 8949, COSE keys from RFC 9053, the user present, user verified, backup eligible and backed up flags, the AAGUID and the signature counter. ### Signature check The sign-in signature over the authenticator data and the client data hash is verified with Web Crypto using the public key from registration, for ES256, EdDSA and RS256 credentials. The client data type is always checked. The browser test compares the challenge, origin and relying party ID hash with the values the page used. For pasted responses they are compared with the values you enter, the registration challenge with the registration and the sign-in challenge with the sign-in; an empty field is not compared. When user verification is set to required, the user verified flag must be set in both the registration and the sign-in, as WebAuthn Level 3 sections 7.1 and 7.2 require. ### Test passkey The test passkey uses a random user ID on this site only and is never sent anywhere. Where the browser supports it, the tool asks the passkey provider to forget it afterwards; otherwise remove it yourself. Attestation statements other than none are reported but not verified.