Passkey lab

Create a real demo passkey (WebAuthn) and see, byte by byte, what the authenticator returns — and why none of it would work on a lookalike domain.

  1. 1

    create the passkey

    The browser asks your authenticator (Face ID, fingerprint, security key) for a credential bound to this origin. The private key never leaves the device.

  2. 2

    open the authenticator response

    This is the real authenticatorData a server would receive — field by field:

    create the passkey in step 1 to see the dissection.

  3. 3

    authenticate and verify the signature

    A simulated "server" on this page issues a challenge; the authenticator signs; the signature is verified with WebCrypto — the same math a real server would do:

Why phishing fails: The passkey signs the origin the browser saw, not the one the user thinks they are on. On a lookalike domain (danielmala.co.secure-login.xyz) the browser looks for credentials for that domain, finds none, and the attack dies before there is a password to steal. There is no 6-digit code to intercept and no hash to crack — phishing resistance is not a promise, it is arithmetic.
▲ The passkey you create is real and stays in your manager. When done, delete it in your device/browser password settings (look for danielmala.co). This page stores nothing — it has nowhere to.

🔒 100% in-browser. No data is ever sent to any server.

← Back to tools