INTERACTIVE TECHNIQUE // FIDO + WEBAUTHN
ENTER THE
PASSKEY LAB.
Build the credential. Trace the proof. Attack the protocol. This guided simulation shows which authentication data stays local, what reaches the service, and why a reusable password never enters the fight.
EDUCATIONAL SIMULATION · NO ACCOUNT OR REAL PASSKEY CREATED
LAB PROGRESS00 / 03
LIVE PROTOCOL CONSOLEAWAITING CEREMONY
CHALLENGE // 7A9F3C21B6E4D805PHASE 01 / 05
Registration requested
The relying party asks the browser to create a credential for its RP ID and account.
› navigator.credentials.create() requestedDATA BOUNDARY LENS
FOLLOW
THE DATA.
Passkeys protect authentication by changing what must be trusted and what must be stored. Choose a boundary to inspect the exact categories involved.
INSIDE THE TRUST BOUNDARY✓Private keyNever sent to the relying party ✓Biometric templateProcessed by the device ✓Device PINChecked locally
WHAT STAYS LOCAL
A synced passkey may be protected and synchronized by a passkey provider, but the relying party still never receives the private key.
OPEN-STANDARD FOUNDATION
SIMULATED HERE.
SPECIFIED IN PUBLIC.
This lab teaches the registration and authentication model described by the FIDO Alliance and the W3C Web Authentication specification. It does not call your device’s real passkey APIs or collect authentication data.
How passkeys work — FIDO Alliance ↗︎Web Authentication Level 3 — W3C ↗︎Discuss an IDEMIA passkey program →