Home▸Cybersecurity▸Passkeys / FIDO2: Public-Key Registration & Challenge-Response Login

🔑 Passkeys / FIDO2: Public-Key Registration & Challenge-Response Login

Interactive passkeys / FIDO2 / WebAuthn simulator: watch a device generate a key pair locally during registration, sign a server challenge during login, and see why a phishing domain mismatch is rejected — with a side-by-side password comparison.

Cybersecurity2DEasy60 FPS

Details

CategoryCybersecurity

RenderingCanvas 2D

DifficultyEasy

Target FPS60

ControlsRegister passkey button generates a key pair on the device and sends only the public key to the server; Login attempt button runs the challenge-response flow (server challenge, device signs locally, server verifies against the stored public key); Simulate phishing attempt button repeats the login from a spoofed origin so the signature is rejected on a domain mismatch; Reset clears all state.

Canvas 2DWebAuthnFIDO2passkeyspublic-key cryptographyphishing resistance

Related simulations

Digital Forensics Lab: File Carving, Deleted Data & Chain of CustodyDelete files from a simulated disk block map and watch the filesystem mark their space free…

Risk-Based Patch Prioritization: CVSS vs Exploit-in-the-WildRun the same 20-item vulnerability backlog and the same limited per-cycle patching capacity…

SASE Architecture: Legacy Hub-and-Spoke vs Distributed PoPCompares two remote-access architectures side by side: legacy hub-and-spoke, where every… ⊞ All 217 in Cybersecurity →

⚙ Under the hood

Watch a WebAuthn/FIDO2 passkey flow step by step: the device generates a public/private key pair locally and sends only the public key to the server during registration, then signs a random server challenge with the private key during login. A phishing button spoofs the origin so you can see why a signature scoped to the wrong domain is rejected, plus a side-by-side comparison against password-based auth.

Canvas 2DWebAuthnFIDO2passkeyspublic-key cryptographyphishing resistance

2D · HTML5 Canvas 2D · 60 FPS target · runs fully client-side, no install