Credential Management / WebAuthn Tester

WebAuthn is hard to experiment with without a backend. This tester builds create() and get() requests visually, triggers your browser's native passkey prompt with a local challenge, and shows the decoded credential response.

PWA & Browser Storage Local processing The challenge is generated locally. Nothing is sent to a server.

Introduction

Passkeys are the future of authentication, but experimenting with WebAuthn usually means wiring up a server. This tester removes the server from the loop so you can see the raw credential flow in your own browser.

How it works

Generates a cryptographic challenge with crypto.getRandomValues.
Builds PublicKeyCredentialCreationOptions or RequestOptions.
Calls navigator.credentials.create() or .get().
Decodes ArrayBuffers to Base64URL and shows the result or error.

Privacy

The challenge and credential data stay in your browser. Nothing is transmitted to a server. No account, no API key.

Limitations

Cannot verify attestation signatures without a backend.
Requires a secure context and a device with an authenticator.
Created credentials are real but have no server-side record.

FAQ

Why do I see a NotAllowedError?

Common causes: the operation timed out, the user dismissed the prompt, or the rpId doesn't match the current origin.

Is my credential data uploaded?

No. Everything stays in your browser.

Related tools

Version and changelog

Version: 1.0.0
Last updated: August 12, 2026
Changelog: Initial production release.