← All practicals

Prove a passkey’s make and model

Register a passkey with attestation, then read what it actually proved.

1. 1

   On your account page, check "Request attestation" before registering a passkey.

   This asks the authenticator for attestation:'direct' instead of the default 'none' — a signed statement about the device itself, not just its public key.

2. 2

   The Lab cryptographically verifies the attestation statement your authenticator returned.

   @simplewebauthn/server checks the statement's own signature (self-signed by the credential's key, or by a manufacturer certificate) — a tampered statement is rejected the same way a tampered signature is.

3. 3

   Read the honest badge on your new passkey.

   The Lab never claims more than it verified: a certificate-backed statement is labeled "root unverified" (no chain-of-trust lookup is performed — see the Academy lessons on why that would mean a live network call), and a self-signed statement is labeled "device key". Neither is ever shown as fake-"verified".