SYSSEDER / AUTHENTICATION LAB
WebAuthn test playground
Create a disposable test passkey, request an assertion, and inspect what your browser actually returns. No account. No password. No backend.
Test credentials only
This is not a sign-in service or a production authentication verifier. This page performs local educational checks. It has no trusted server, durable challenge/replay protection, account recovery or attestation trust validation.
A credential can persist on your security key, device or synced password manager. Clearing this page does not delete it; remove “SysSeder TEST ONLY” in your authenticator/password manager afterward. Never use a real account name or password here.
This tool sends no credential data, telemetry or analytics. However, Blogger, its theme, ads and other scripts share this page’s execution environment and may access page data. Do not use it for sensitive credentials. The private key stays with the authenticator, not this page.
Origin: Checking… · RP ID: Checking…
1. Configure your experiment
Disposable test identity is generated locally.
Advanced registration & authentication options
Extensions can be ignored. Missing output does not establish support or failure. credProtect is authenticator-processed; its effective policy is not decoded here. Transports are hints, not proof. Direct/indirect attestation is only inspected, never trusted here; enterprise attestation is excluded.
0 test credentials in this page’s memory.
Checking browser support…
2. Inspect local results
Registration checks are not attestation verification. Only an assertion with a verified signature is labeled cryptographically verified. Credential IDs, public keys and assertion bytes are not exported. Results disappear on reload.
No ceremony has run.
Capability & coverage matrix
| Feature | This playground |
|---|---|
| WebAuthn / secure context / platform authenticator | Checking API availability… |
| Browser-reported client capabilities | Checking… |
| Registration & assertions | User-triggered; current hostname only; session-memory public keys. Browser response helper APIs required for registration. |
| Local verification | Type, challenge, origin, RP ID hash, UP, required UV, backup flags, attested credential ID; ES256 / RS256 / Ed25519 signatures if WebCrypto supports the key. Counter anomalies are reported, not a clone verdict. |
| credProps / largeBlob support / credProtect | Optional registration requests. Client extension results displayed; no claim every authenticator supports them. Authenticator extension CBOR not decoded. |
| PRF / hmac-secret / largeBlob read or write | Intentionally deferred: secret outputs and persistent authenticator data need a separately isolated workflow. No PRF evaluation, secret export or blob mutation. |
| Attestation trust / enterprise attestation | Not verified / not requested. No certificate-chain, metadata or hardware-provenance claims. |
| Conditional autofill / related origins / appid / payments / credential-management signals | Not exercised: avoid account integration, legacy credentials, payment or credential-state changes. Capability reporting does not test these flows. |
| Server authentication / persistent replay defense | Not provided. Requires a trusted relying-party backend and a proper security design. |