A passkey example you can experience
This demonstration asks the browser to create a genuine public-key credential for login.com using a random local challenge and a fixed fictional demo identity. Your browser or credential manager chooses where the passkey can be stored and asks for device verification. The page keeps the credential identifier only in memory long enough to request it again. There is no login.com account, server registration, or server-side verification behind the exercise.
A production passkey system sends a challenge from a server, verifies the signed response, associates the public key with an account, prevents replay, and manages recovery and credential deletion. This page deliberately does none of that. It demonstrates the user ceremony: an intentional create action, the browser’s trusted prompt, device approval, and a later request to use the matching credential.
What happens when you create the test passkey
After you select Create demo passkey, the browser receives a relying-party name, the current login.com relying-party identifier, a random challenge, a random fictional user identifier, and requirements for a discoverable credential with user verification. The authenticator creates a key pair. The private key remains protected by the authenticator or credential provider, while the public credential information is returned to the page.
The prompt you see belongs to the browser, operating system, or credential provider rather than to a styled form drawn by login.com. That boundary is important. A real service should begin enrollment from its verified security settings. You may be offered a built-in credential provider, a nearby device, or a security key depending on platform policy. Canceling is safe and is reported as a canceled ceremony.
How the use step feels
The Use demo passkey button creates a new random challenge and asks for the credential identifier created during this page session. The authenticator checks the relying-party domain, prompts for the appropriate local approval, and returns a signed assertion. The demo confirms only that the browser returned the expected credential identifier. It does not cryptographically verify the assertion because there is no server holding the registered public key.
That domain binding is the property that makes passkeys resistant to many fake-login pages. An authenticator registered for login.com will not normally satisfy a request from a lookalike domain. The protection does not extend to every account threat. Someone with an unlocked session may change settings, and weak recovery can bypass a strong daily authenticator. Passkeys should be part of a complete account plan.
Delete the throwaway passkey afterward
The WebAuthn browser API does not give this page a universal delete command for a credential stored in your provider. After the lesson, open the password or credential manager named in the creation prompt, search for login.com, and remove the entry labeled Temporary login.com passkey demo or similar. If you used a hardware security key, use that key’s management software when it exposes resident-credential deletion.
Closing or refreshing this page forgets the credential identifier held in memory, so the Use button can no longer target it from this session. That does not necessarily remove the credential from its provider. Cleanup is intentionally explained because production sites should treat credential lifecycle as seriously as enrollment. On a real account, always register and test an independent recovery method before deleting an older passkey.
Practical sequence
How to use this tool safely
- 01
Run the support check and read the relying-party and privacy notes.
- 02
Select Create demo passkey and approve only the browser or operating-system prompt you intentionally triggered.
- 03
Select Use demo passkey to request the same credential with a fresh local challenge.
- 04
Open your credential manager afterward and delete the temporary login.com demo entry.
Common questions
Passkey demo FAQ
Is this connected to a login.com account?
No. The demo uses a fictional identity and performs no account registration or server verification. It exists only to demonstrate the browser ceremony.
Where is the demo passkey stored?
Your browser, operating system, credential provider, or hardware key decides. Read the trusted prompt during creation, then use that provider’s management screen to remove the login.com demo credential.
Why can’t the page delete the passkey for me?
WebAuthn does not provide websites with a universal credential-delete operation. Deletion is controlled by the credential provider or hardware-key manager so one site cannot silently manage unrelated credentials.
Can I use this demo to test account recovery?
No. There is no account or server in this lesson. Recovery is service-specific and should be prepared on the real service before an older authenticator is removed.
References