Does a successful check mean I already have a passkey?

No. The browser can report APIs and whether an authenticator appears available. It cannot list passkeys you created on other sites, and a passing check does not mean the next ceremony will succeed.

Did this create an account?

No. The demonstration credential is stored by your authenticator for this site name. passwords.lu does not receive the private key and has no user account attached to it.

Why did my device ask for Face ID, Touch ID, or a PIN?

A passkey uses user verification so the authenticator confirms a person is present. That prompt comes from the device, not from a passwords.lu login.

Why can creation fail after the checks look fine?

You may dismiss the prompt, the device may have no screen lock, or a security key may not support discoverable credentials. An embedded webview can also block WebAuthn. Availability is not a guarantee.

How is this different from the TOTP generator?

TOTP proves you can produce a short-lived code from a shared secret. A passkey proves the authenticator holds a private key for this exact site. The tools do not share secrets.

Is your device ready for passkeys?

See what this browser can do with WebAuthn, then optionally create a demonstration passkey and sign in with it. This does not create an account.

The checks stay in this page. A demonstration passkey is stored by your device or password manager. The private key never leaves that authenticator. This page keeps the public key in this browser session only, so it can check the signature here.

Browser checks

WebAuthn is available, with no platform authenticator reported

You can still try a security key below. A missing platform check does not prove that every passkey operation will fail.

Secure context
Available
This page is HTTPS or localhost, which WebAuthn requires.
WebAuthn API
Available
PublicKeyCredential is present, so this browser can start a ceremony.
User-verifying platform authenticator
Not available
No user-verifying platform authenticator was reported. A security key or phone may still work.Available means the browser sees a capable authenticator. It does not mean a passkey is already saved.
Passkey autofill
Available
This browser can offer a passkey from a sign-in form.This page does not open that prompt, so a demo is not mixed with another passkey for this site.
Phone approval by QR code
Not available
Hybrid transport was reported as unavailable.

Detailed client capabilities

userVerifyingPlatformAuthenticator
This device can confirm it is you with biometrics or a device PIN.
Not supported
passkeyPlatformAuthenticator
A built-in passkey provider is available.
Not supported
conditionalGet
Sign-in fields can offer a saved passkey.
Supported
conditionalCreate
The browser can offer to create a passkey after a password sign-in.
Supported
hybridTransport
A phone can approve sign-in on this computer with a QR code.
Not supported
relatedOrigins
Related Origin Requests, so associated domains can share a passkey.
Supported
signalAllAcceptedCredentials
A site can tell the device which passkeys are still accepted.
Supported
signalCurrentUserDetails
A site can update the name shown for a passkey.
Supported
signalUnknownCredential
A site can ask the device to hide a passkey it no longer accepts.
Supported
extension:credProps
Registration can report whether the new credential is discoverable.
Supported
extension:prf
The authenticator can derive a key for encryption, via the PRF extension.
Supported
extension:largeBlob
The authenticator can store a larger blob alongside the credential.
Supported
extension:appid
Supported
extension:appidExclude
Supported
extension:credBlob
Supported
extension:credentialProtectionPolicy
Supported
extension:enforceCredentialProtectionPolicy
Supported
extension:getCredBlob
Supported
extension:hmacCreateSecret
Supported
extension:minPinLength
Supported
extension:payment
Not supported

Try a demonstration passkey

This creates a discoverable credential with user verification, the same shape as a passkey on a real site. It is not linked to an account.

Your device or password manager will save a real passkey for this site, with the account name passkey-demo@passwords.lu. Delete it later from that password manager, iCloud Keychain, Google Password Manager, or Windows Hello. Forgetting it here only removes the public key from this browser session.

The challenge is created in this page, and the signature is checked here with the public key from registration. A production site should create the challenge on a server and verify the signature there. This ceremony is not sent to a server.

This host is not passwords.lu. The demonstration passkey is saved for the current host only.

Relying party id: localhost
Account name: passkey-demo@passwords.lu
Where to find it: Search your password manager for passkey-demo@passwords.lu.

Passkeys, passwords, and TOTP

A passkey replaces the password with a key bound to the real site. TOTP adds a short code from a shared secret, and a phishing site can still relay that code.

Passkeys, passwords, and TOTP
Topic	Passkey	Password	TOTP
What you keep	A private key on the device or in its password manager. You confirm with biometrics or a device PIN.	A secret you remember or store.	A shared secret in an authenticator app, usually beside a password.
Phishing	The signature is bound to the real site. A lookalike domain cannot use it.	The secret can be typed into a fake page.	A real-time phishing site can relay the current code.
Server breach	The server stores a public key.	The server stores a hash that can be attacked offline.	The server stores the shared secret. A copy can mint valid codes.
Lost phone	Depends on sync, another device, or a recovery method the site offers.	It still works anywhere if you know it.	Needs the authenticator app, a backup, or the site's recovery codes.
On this site	Browser support, plus a live create and sign-in on this page.	Strength and breach tools elsewhere on passwords.lu.	Generate and check codes in the TOTP tool.

Open the TOTP generator What passkeys are What TOTP is Why passkeys resist real-time phishing

Developers

What a relying party still has to do

Capability detection is not an integration test. A production site issues a fresh challenge from the server, verifies the signature with the stored public key, and checks the origin and relying party id. This page does those checks locally so you can see a ceremony without an account. Sign-in asks only for this demonstration credential, so the prompt is not a sign-in with any other passkey for this site.

Browser checks

Secure context

WebAuthn API

User-verifying platform authenticator

Passkey autofill

Phone approval by QR code