Passkey browser capability test
Check what passkey features this browser offers, and optionally create a test passkey and sign in with it to see the authenticator flags. You can also paste a WebAuthn response from your own app to decode and verify it.
Pasted JSON up to 100000 characters; CBOR up to 16 levels and 2000 items. Everything runs locally in your browser; the ceremony needs a secure page. Download a JSON report. Leave empty to test this browser, or paste a registration response JSON. Up to 100,000 characters. Review the settings before running.
Your result
How to use Passkey browser capability test
- Leave the box empty to test this browser, or paste a registration response JSON from your app and enter the values you expect.
- To run a real test, tick the option to create a test passkey and choose the verification settings.
- Run the tool and follow your browser's passkey prompt if one appears.
- Read the capabilities, flags and checks, and remove the test passkey from your password manager if it stays.
Useful next steps
What it checks
Capabilities come from the browser's PublicKeyCredential methods, including user verifying platform authenticators, conditional mediation and getClientCapabilities where available. Registration and sign-in data are decoded following WebAuthn Level 3 (W3C): CBOR from RFC 8949, COSE keys from RFC 9053, the user present, user verified, backup eligible and backed up flags, the AAGUID and the signature counter.
Signature check
The sign-in signature over the authenticator data and the client data hash is verified with Web Crypto using the public key from registration, for ES256, EdDSA and RS256 credentials. The client data type is always checked. The browser test compares the challenge, origin and relying party ID hash with the values the page used. For pasted responses they are compared with the values you enter, the registration challenge with the registration and the sign-in challenge with the sign-in; an empty field is not compared. When user verification is set to required, the user verified flag must be set in both the registration and the sign-in, as WebAuthn Level 3 sections 7.1 and 7.2 require.
Test passkey
The test passkey uses a random user ID on this site only and is never sent anywhere. Where the browser supports it, the tool asks the passkey provider to forget it afterwards; otherwise remove it yourself. Attestation statements other than none are reported but not verified.