WebAuthn & Passkey Tester

Checking WebAuthn support…

About This Tool

This tool tests whether your browser and device support WebAuthn passkeys, the FIDO2-based standard for passwordless authentication. It calls navigator.credentials.create() to register a test passkey and navigator.credentials.get() to authenticate with it. No credentials are sent to any server. Use this to verify that Touch ID, Face ID, Windows Hello, or a hardware security key (YubiKey) works correctly in your browser before implementing WebAuthn in an application.

How to Use

1. Click Register Passkey. Your browser will prompt for biometric (Touch ID, Face ID, Windows Hello) or security key authentication.
2. Approve the prompt. The tool shows the credential ID and public key details.
3. Click Authenticate to test signing with the registered credential.
4. A success message confirms your device and browser fully support passkeys.

Common Use Cases

• Rolling out passkeys to a team: before enabling passkey login for coworkers, run this test on a sample of the actual laptops and phones in use to confirm the browser and OS combination actually exposes a platform authenticator, instead of finding out during a live rollout.
• Debugging a silent passkey registration failure: when a user reports that "nothing happens" when they click a passkey button on a production site, run Test 1 here to see the exact DOMException name (NotAllowedError, NotReadableError, NotSupportedError) instead of guessing blind.
• Checking an older Android device before support tickets pile up: some Android 8 and earlier devices, or devices without a configured screen lock, report WebAuthn as present in the API but fail registration. This tool surfaces that gap immediately.
• Verifying a YubiKey or other hardware key works in a given browser: plug in the security key, run Test 1, and confirm the browser correctly hands off to the external authenticator rather than only offering the built-in biometric prompt.
• Pre-flight check before a WebAuthn implementation: developers building a passkey login flow can use this page as a quick sandbox to confirm the target device class supports navigator.credentials.create() before writing server-side registration code.

Passkeys vs TOTP: Tradeoffs

TOTP 2FA (the 6-digit codes from apps like Google Authenticator) works on any device with a camera or manual entry, requires no platform-level biometric hardware, and is trivial to back up as a plain secret string. Its weakness is that a user can be tricked into typing the code into a phishing site, since the code itself carries no binding to the real domain. Passkeys fix that: the private key is generated per-website and never leaves the device, so a fake login page simply cannot obtain a valid signature. The tradeoff is device dependency, a passkey created on one phone does not automatically work on a different computer unless the platform supports syncing (like iCloud Keychain or Google Password Manager) or the user has a hardware key. For most consumer accounts, passkeys are the stronger option going forward; TOTP remains useful as a portable fallback method.

Troubleshooting

• The "Test Passkey Registration" button does nothing when clicked: WebAuthn requires a secure context. If the page is somehow being served over plain HTTP instead of HTTPS (or from a raw IP address instead of localhost during local development), the browser silently blocks the API. 2FA Fast is served over HTTPS in production, so this should not occur here, but it is the first thing to check on a custom implementation.
• Registration fails with NotReadableError on Android: this is typically a hardware or driver level error from the device's secure element, not a code bug. Confirm a screen lock (PIN, pattern, fingerprint, or face) is actually configured in the device's system settings, then restart the browser and retry.
• Authentication (Test 2) says "no passkey found" right after a successful registration: some browsers scope resident keys per top-level origin strictly. Make sure Test 1 was run on this same domain and that the browser profile has not been changed or reset between the two tests.
• The biometric prompt never appears at all on desktop: check whether Windows Hello or Touch ID is actually enrolled at the OS level. Browsers cannot prompt for a biometric method the operating system has not set up, they will fall back to a security key prompt instead, which can look like nothing happened if no key is plugged in.

Frequently Asked Questions