EXPERIMENT / 001 / WEB AUTHENTICATION

A key
ceremony.

WebAuthn lets your device prove it holds a private key without sharing that key. This lab shows each handoff between your browser, your authenticator, and the server.

THE SHAPE OF IT

Three handoffs, one proof

01
The server creates a one-time challenge
Fresh random bytes prevent an old response from being reused.
02
Your device signs the challenge
A face, fingerprint, PIN, or security key authorizes the private key.
03
The server checks the proof
It checks the challenge, site address, and signature against the stored public key.

RUN THE FULL CEREMONY

Try it in this browser

Secure page: no
Browser support: unavailable
Built-in passkey: unknown

Demo account name Use 3–64 letters, numbers, dots, underscores, or hyphens. This label is for the demo—not proof of identity.

Checking passkey support

No passkey verified in this browser session yet

ceremony.json sensitive identifiers redacted

Create or use a passkey to inspect the one-time challenge and the checks performed by the Worker.

FIELD NOTES

What this demo leaves out

This is a real WebAuthn exchange. The Worker issues a one-time challenge, the browser asks your authenticator to sign it, and the Worker checks the site, signature, and user verification. D1 stores the demo account, passkeys, and session.

This remains a learning lab, not a production account system. It includes layered rate limits, short-lived re-authentication before credential changes, and privacy-preserving management references. It does not include identity proofing, account recovery, security alerts, or production abuse monitoring.