# Passkey (WebAuthn) Test

Whether passkeys work depends on the browser and the device together. This page lists the WebAuthn API, the platform authenticator with user verification and conditional UI, and can create one test passkey and sign in with it. No server is used.

- URL: https://tools.itlibra.com/en/passkey-webauthn-test
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. When the page opens, it checks this browser and device: the WebAuthn API, the platform authenticator, conditional UI and a secure context. Nothing is created at this stage.
2. Press “Create a test passkey”. One test passkey is saved in this device’s password manager. Read the notice shown before you press it.
3. Check the attributes of the new passkey: the attestation format, the flags UP, UV, BE, BS and AT, the AAGUID, the key type and the transports.
4. Press “Try signing in with this authenticator” to get a signature, then check the counter, user verification and the signature check made with WebCrypto.
5. When you no longer need it, delete the test passkey in your device or browser password manager.

## Use cases

- Check that registration and sign-in work on this device before you add passkeys to your site
- Tell apart the causes of “passkeys do not work” reports, using the browser and device support
- Check through the UV flag whether biometrics or a PIN is verifying the user
- Read a real WebAuthn authenticator data block and signature to learn how they are built

## What it does

### Support at a glance

Shows whether the WebAuthn API exists, the platform authenticator, conditional UI, a secure context, and getClientCapabilities (every item, where the browser supports it).

### Reads the registration

Decodes the CBOR itself and shows the attestation format, flags, AAGUID, key type (the COSE alg) and transports.

### Checks the signature on the spot

Verifies the signature from sign-in with WebCrypto and shows the result. Covers passkeys made with ES256 and RS256, the two algorithms this page asks for.

### Plain explanations of failures

Explains each cause, such as cancelling, a timeout, a security restriction or the state of the authenticator, and what to do next.

### Sends nothing

Registration and sign-in happen on this device, with no request to any server. The results are not kept on this page.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| WebAuthn API available | Supported | — |
| Platform authenticator (biometrics or PIN) available | Supported | The result of isUserVerifyingPlatformAuthenticatorAvailable() |
| Conditional UI (passkeys offered as suggestions) available | Supported | The result of isConditionalMediationAvailable() |
| Full getClientCapabilities list | Partial | Shown only where the browser supports it |
| Creating a test passkey | Supported | One passkey is saved in this device’s password manager |
| Signing in with it and checking the signature | Supported | ES256 and RS256, the two algorithms this page asks for |
| Showing the authenticator’s product name | Not supported | The AAGUID is shown as a number only; no product list is kept |
| Checking the registration certificate (attestation) | Not supported | The format and contents are read only |
| Server-side registration and verification examples | Not supported | No server code is shown |
| Sending anything to a server or storing it there | Not supported | Everything happens on this device |
| Deleting the test passkey | Not supported | This page cannot remove it; delete it in the device or browser |

## Limits & notes

- Each press creates one more test passkey, named “LIBRA Works test”.
- The rp.id is this site’s host name. Passkeys of other sites are not handled.
- When an authenticator hides its model, the AAGUID is all zeros.

## Privacy & safety

Checking, registration, sign-in and the signature check all happen in your browser. Nothing is sent to a server. The test passkey is kept in your device’s password manager; this page does not store it.

## FAQ

### How do I check whether passkeys are supported?

When the page opens, it checks the WebAuthn API, the platform authenticator and conditional UI automatically. If the API is missing, the usual causes are an old browser or a page that is not on a secure (https) connection.

### What if the platform authenticator shows false?

Biometrics or a screen-lock PIN may not be set up on the device, or that authenticator is not usable. Turning on a screen lock in the device settings may change the result to true.

### What is conditional UI?

It offers saved passkeys as suggestions in the ID field (autofill). Even when the value is true, nothing is shown unless the site supports it.

### What does NotAllowedError mean?

It appears when you cancel, the time runs out, or no authenticator on this device can be used. Press the button again and follow the prompts.

### What is an AAGUID?

It is a 16-byte identifier of the authenticator model defined in the W3C specification. This page keeps no product list, so it shows the number only.

### How do I delete the test passkey?

Delete it from your device or browser password manager (the passkey list). This page cannot delete it.