Passkey & WebAuthn Flow Debugger

Passwords are shared secrets — you create one, the server stores a hash of it, and you prove you know it on login. This means password databases are breach targets and users reuse weak passwords. Passkeys use public-key cryptography: the device generates a key pair, keeps the private key in a secure enclave (never transmitted), and registers the public key with the server. Sign-in works by the device signing a server-issued challenge — there is no secret to steal from the server, and phishing is eliminated because the credential is scoped to the exact origin (domain).

FIDO2 is the umbrella standard from the FIDO Alliance that defines passwordless authentication. It has two components: WebAuthn (Web Authentication) is the W3C browser API — the JavaScript navigator.credentials.create() and navigator.credentials.get() calls. CTAP (Client-to-Authenticator Protocol) is the protocol between the browser and external authenticators (USB security keys, NFC cards). When you implement WebAuthn in your web app, you are using FIDO2. The terms are often used interchangeably. Passkeys are the user-friendly brand name for synced FIDO2 credentials (backed up to iCloud Keychain, Google Password Manager, etc.).

A resident credential (also called a discoverable credential or passkey) stores the user handle on the authenticator itself — alongside the private key. This enables usernameless authentication: the user visits your login page, taps 'Sign in with Passkey', and the authenticator presents matching credentials without the user typing a username first. Non-resident credentials require the server to know which credential IDs belong to the user (via allowCredentials) before the browser can proceed. Set residentKey: 'required' in authenticatorSelection to mandate discoverable credentials.

Passkeys sync across a user's devices via cloud keychain providers: Apple syncs via iCloud Keychain across iPhone, iPad, Mac, and Safari on Windows. Google syncs via Google Password Manager across Android and Chrome. The private key is stored in the platform's secure enclave and only the encrypted key material is synced — the raw private key never leaves the device. For cross-device sign-in (e.g., signing into a laptop using a phone), WebAuthn uses Bluetooth proximity via CTAP 2.2 hybrid transport: the laptop shows a QR code, the phone scans it, and authentication completes over an encrypted BLE channel. This prevents remote phishing even in cross-device flows.