Passkey Checker: Does Your Device Support Passkeys?
See whether your phone, laptop, and browser support passkeys, then create a real test passkey and authenticate with it. The checker inspects authenticator flags and attempts cryptographic signature verification locally in your browser session.
- Runs in your browser
- Real passkey test
- Signature checked locally
Checking your device…
Your device
Try a real passkey
-
Create a test passkeyYour device prompts for your screen lock, biometrics, PIN, or security key if configured.
-
Sign in with itVerifies the passkey signature against the public key from step 1.
-
Remove it (manual)This tool cannot delete a passkey from your authenticator.
About your test passkey
How to test it
- Review Your device status. A platform authenticator is confirmed on phones with screen lock or laptops with Windows Hello / Touch ID enabled.
- Press Create test passkey and authorize the prompt on your authenticator.
- Press Sign in with passkey in the same page session to authenticate and verify the digital signature.
The passkey creation and signature-verification test runs in your browser. The test credential ID and public key are kept in this page session's memory; the private key remains with your authenticator or passkey provider. The page may load third-party resources separately.
How this passkey checker works
Asks your browser
Your browser reports whether it supports WebAuthn, whether a platform authenticator is available with biometric/PIN unlock, and whether autofill or hybrid QR transports are supported.
Makes a real passkey
The test uses standard WebAuthn parameters. Your authenticator generates an asymmetric key pair and reports standard metadata flags back to the browser.
Verifies the signature
When you sign in, the page validates the signed challenge against the public key obtained during creation using the browser's native Web Crypto API.
Inspect it yourself. Open your browser's developer tools (F12), choose the Network tab, and run the test. The test flow uses browser WebAuthn and Web Crypto APIs; the page may load third-party resources separately.
Common passkey questions, answered
Find your problem. The button runs the right check.
| Problem | Answer | Action |
|---|---|---|
| "Can my phone or laptop use passkeys?" | Modern versions of Android, iOS, Windows (with Windows Hello), and macOS all include WebAuthn support. The check above verifies capability flags for your current browser and OS. | |
| "Google asks me to create a passkey. Is that safe?" | Yes, when on the authentic domain. Test the registration and authentication flow here first to see how prompt dialogs work. | |
| "Will I lose my passkeys with my phone?" | Passkeys stored in cloud sync accounts (Google, Apple, Bitwarden, 1Password) can typically be restored upon signing into a new device. Passkeys on hardware tokens remain device-bound. | |
| "My PC shows a QR code instead of Windows Hello" | Ensure Windows Hello (PIN, facial recognition, or fingerprint) is configured in Windows Settings, or scan the QR code with your mobile device over Bluetooth. | |
| "I still use OTP by SMS" | Upgrade to passkeys where offered, or switch to a software authenticator app. Passkeys generally provide stronger phishing resistance than SMS codes, though no method removes every account-security risk. | 2FA Code Generator |
How passkeys work
When you create a passkey, your device generates a unique asymmetric key pair for that relying party (domain). The private key stays inside your secure authenticator or encrypted sync keychain, while the relying party stores only the public key.
To authenticate, the website issues a cryptographically random challenge. Following local user verification (biometrics or PIN), the authenticator signs the challenge. The relying party validates the signature using the stored public key. Passkeys are designed to resist phishing by binding authentication to the website's origin. They do not eliminate every account-security risk, including compromised devices or stolen sessions.
The passkey creation and signature-verification test runs in your browser. The checker verifies the signature, origin, and RP ID hash locally using the Web Crypto API. The page may also load third-party resources.
Sources: W3C Web Authentication, FIDO Alliance: Passkeys, passkeys.dev.
What the test passkey details mean
| Detail | Shows | Why it matters |
|---|---|---|
| Saved on | Platform authenticator, phone via hybrid, or external security key | Indicates the attachment mode of the authenticator. |
| Backup status | Backup eligibility and current backup state flags | Backup eligibility and backup state are reported by the authenticator. They do not independently guarantee that a passkey can be restored on another device. |
| User verification | Whether the authenticator set the user-verification flag | This test asks for verification as "preferred", so it is not guaranteed. The flag does not say whether a biometric or a PIN was used. |
| Sign in without username | Whether a discoverable credential (resident key) was reported | Discoverable passkeys let a site offer account selection without asking for an identifier first. |
| Provider | Identified provider name (if known AAGUID is provided) | Recognizes common authenticators when AAGUIDs are reported by the browser. |
| Algorithm | ES256, EdDSA, or RS256 | Specifies the asymmetric cryptographic signature algorithm used. |
Passkey mistakes to avoid
Passkeys provide strong cryptographic security, but common management oversights can cause lockout or unintended access.
Anyone with access to the local user account could sign in. Use cross-device mobile authentication instead on untrusted machines.
Hardware token loss can result in account lockout. Register a secondary passkey or verify alternative recovery mechanisms.
Local passkeys rely on device lock strength. Use a strong alphanumeric passcode or complex PIN rather than simple 4-digit numbers.
Compromised passwords remain usable if left unchanged. Update or remove weak legacy passwords where passwordless login is enabled.
Good passkey habits
Setting up
- Register passkeys on primary accounts such as email, identity providers, and financial portals.
- Maintain passkeys in trusted, end-to-end encrypted password managers or cloud keychains.
- Ensure at least two authenticators or reliable recovery methods are enrolled per service.
- Keep recovery emails and security numbers up to date.
- Enforce biometric authentication and screen lock timeouts across all personal hardware.
Every day
- Approve passkey authentication prompts only when actively initiating a login.
- Never scan unsolicited QR codes sent via messages, emails, or third parties.
- Revoke and delete credentials from devices prior to sale, return, or decommissioning.
- Periodically audit active passkeys listed in your account security dashboards.
- Keep operating systems and browsers updated with current security patches.
Frequently asked questions
Answers regarding passkey standards, synchronization, and security guarantees.
What is a passkey?
A passkey uses a public-private key pair instead of a traditional password. The private key is held by your device or passkey provider, while the website stores the public key and related credential information. Passkeys are designed to resist phishing because authentication is bound to the website's origin, but device security, account recovery, and session protection still matter.
Is the test passkey sent to your server?
No. The test flow does not send the test credential ID or public key to our server. The credential ID and public key are kept in this page session's memory, while the private key remains with your authenticator or passkey provider. The page may load third-party resources separately.
What happens to my passkeys if I lose my phone?
Passkeys managed by cloud providers (such as Google Password Manager, iCloud Keychain, 1Password, or Bitwarden) are typically synced across devices linked to that account. However, restoration depends on maintaining access to your provider account. Hardware security keys store passkeys locally and do not sync.
Are passkeys safer than OTP by SMS?
Generally, passkeys provide stronger phishing resistance because they are bound to the website's origin. An SMS code can be entered on a fake login page or exposed through a SIM-swap attack. Passkeys do not eliminate every risk, including compromised devices or stolen sessions.
Why does my computer show a QR code instead of asking for my fingerprint?
If your desktop or laptop does not have an active built-in platform authenticator (such as Windows Hello or Touch ID), the browser offers cross-device authentication via FIDO Hybrid. You scan the QR code with your mobile device and authorize it there over Bluetooth.
How do I remove the test passkey?
Browser APIs cannot silently delete credentials from your authenticator. To remove it completely, open your password manager or device settings (e.g., Google Password Manager, Apple Passwords, or Windows Passkey Settings) and delete the entry for allinonetools.net.
Which websites support passkeys?
Major platforms including Google, Microsoft, Apple, Amazon, WhatsApp, GitHub, and PayPal support passkeys. Check the security or sign-in settings of your accounts or reference directory services like passkeys.directory.