← All practicals

Read a passkey like an engineer

AAGUID, synced-vs-device-bound, and autofill — the metadata behind that one-tap sign-in.

1. 1

   On your account page, register a passkey (or look at one you already have).

   Every authenticator reports an AAGUID — a make/model identifier — plus whether it's a synced (multiDevice) or device-bound (singleDevice) credential. The Lab decodes both into a friendly name and a Synced/Device-bound badge instead of showing you an opaque GUID.

2. 2

   Notice the Synced vs Device-bound badge on each passkey.

   This is the single most security-relevant property of a passkey: a synced one roams across a cloud keychain (recoverable if you lose the device, but now the keychain provider is in your trust boundary); a device-bound one (a security key, most enterprise setups) never leaves that one piece of hardware.

3. 3

   Log out, then start typing on the sign-in page — if your browser supports it, a passkey suggestion appears in the native autofill dropdown before you press any button.

   That's conditional UI (`mediation: 'conditional'`): the Lab starts a passkey request in the background on page load, and the browser surfaces matching discoverable credentials right in the input's autofill list — one tap, no typing, and it degrades invisibly to the ordinary button on a browser that doesn't support it.