Everything the server knows
Not a redacted view — this is the whole database. Imagine it leaked tomorrow and ask yourself what an attacker could do with it.
1
accounts
1
public keys stored
0
passwords stored
0
password hashes stored
Raw records
Refreshes every few seconds, so you can leave this open while you register in another window.
{
"users": [
{
"id": "KbjXHM8nyeiUsseCfgeqs9h7mUFySOG7ViyC31BthI4",
"username": "passkeydemo",
"displayName": "passkeydemo",
"createdAt": "2026-08-29T02:17:50.561Z",
"credentials": [
{
"id": "5XqbxTWfYkB-yw-_hwaDRHdu63TmreGcBjqmYtlJvnw",
"publicKey": "pQECAyYgASFYIESmF8v8iJVFiXIVRdeCFBV8NqeY-VcRBG1yB36BJRx0IlggYhWmUj6ApHf045hIMa2CroLu5z0t_rcyGi0vScTiagU",
"counter": 1,
"transports": [
"internal"
],
"deviceType": "singleDevice",
"backedUp": false,
"aaguid": "08987058-cadc-4b81-b6e1-30de50dcbe96",
"nickname": "This device (built-in)",
"createdAt": "2026-08-29T02:17:50.561Z",
"lastUsedAt": "2026-08-29T02:18:33.649Z"
}
]
}
]
}Relying Party configuration
{
"rpName": "Passkey Demo",
"rpId": "passkey.karanpatel.ca",
"origins": [
"https://passkey.karanpatel.ca"
],
"storeDriver": "redis"
}rpId is the domain every passkey above is bound to. Change it and every existing passkey stops working — which is the same reason a look-alike domain can't use them.