New: Passkey Benchmark 2026 · compare your rollout

Platform authenticator test

Platform authenticator test: Face ID, Touch ID, Windows Hello and Android

Create a passkey with the authenticator built into this device and see what it returns: whether it verified you, which provider stored the passkey and whether it is synced or stays on the device.

Start the platform authenticator test See a real Windows Hello result
  • About 1 minute
  • macOS, iOS, Windows or Android
  • Screen lock or biometrics set up
A laptop with face scan and a phone with fingerprint, synced through the cloud, with the checks user verification, provider, synced and platform authenticator

What the test checks

  • User verification

    Whether Face ID, Touch ID, Windows Hello or the screen lock verified you.

  • Provider

    Which passkey provider stored it, from the AAGUID: Apple Passwords, Google Password Manager, Windows Hello or a password manager.

  • Synced or device-bound

    Whether the passkey is backed up to the user's other devices.

  • Attachment

    That the browser returned a platform authenticator, not a phone over QR.

Test your platform authenticator in four steps

  1. 1

    Open the prepared test

    The link sets platform attachment, a discoverable credential, required user verification and the client-device hint. The username platform-authenticator-test stays the same, so a repeated test replaces the passkey.

    Open the prepared test
    Debugger options prepared for a platform authenticator: platform attachment, discoverable credential required, user verification required and the client-device hint
  2. 2

    Create the passkey

    Click Create passkey and confirm with Face ID, Touch ID, Windows Hello or your screen lock. If a password manager extension opens instead, it is acting as the platform authenticator. The result will name it.

  3. 3

    Read the result

    The result strip names the provider and shows the flags. Here a Windows Hello passkey: verified, device-bound and built into the device. Its self attestation proves the response is intact, not which product made it.

    User verified
    Windows Hello checked the PIN, face or fingerprint.
    Device-bound passkey
    No backup flags: the passkey stays on this Windows device.
    Platform authenticator
    Attachment platform, transport ["internal"].
    Self attestation
    Signed with the passkey's own key, no manufacturer certificate.
    Windows Hello result: user verified, device-bound passkey, platform authenticator with the internal transport, self attestation
  4. 4

    Compare synced and device-bound

    The same test with Google Password Manager on Android sets both backup flags: the passkey syncs to the user's other devices. The hybrid transport means a nearby phone can use it over QR and Bluetooth.

    Log in on the Authentication tab and Share the session when you want a second opinion.

    Google Password Manager result on Android: user verified, synced passkey, platform authenticator with internal and hybrid transports

When the test fails

Most failures come from the device setup, not from the options.

  • User verifying platform authenticator not available

    isUserVerifyingPlatformAuthenticatorAvailable() is false: no screen lock, Windows Hello not set up, or a virtual machine or remote desktop session.

    Set up a screen lock or Windows Hello and reload. The browser check at the top of the debugger shows the result.

  • NotAllowedError

    The prompt was cancelled, timed out or the user verification failed.

    Run the test again and finish the prompt. If it fails at once, check the browser check for user verifying platform authenticator.

  • The browser shows a QR code

    No platform authenticator matched, so the browser offers a phone instead.

    Check that the device supports passkeys and that attachment is set to platform.

  • A password manager answers instead

    Extensions such as 1Password or Bitwarden can take over passkey requests in the browser.

    That is a valid result. The AAGUID names the provider. Disable the extension to test the built-in authenticator.

Questions

What is a platform authenticator?
The authenticator built into a device: Face ID and Touch ID with Apple Passwords, Windows Hello, or the Android screen lock with Google Password Manager. Password managers such as 1Password can take over this role in the browser.
What does "user verifying platform authenticator not available on your device" mean?
The browser reports that isUserVerifyingPlatformAuthenticatorAvailable() is false. Usually the device has no screen lock, Windows Hello isn't set up, or the browser runs in a virtual machine or remote session. The browser check at the top of the debugger shows this result.
Why is my platform passkey synced?
Apple Passwords and Google Password Manager back passkeys up and sync them across the user's devices, so backup eligibility and backup state are set. Windows Hello keeps passkeys on the device unless a password manager stores them.

Related

Stuck on a result? Ask in the passkeys community on Slack and share the session link.

Corbado Observe

The debugger shows one login. Observe shows all of them.

The same client-side detail for every login in production, so you see where users fail before support tickets do.

See Corbado Observe Talk to an expert

  • Every authentication method

  • Per-user journeys

  • Device readiness

  • Your existing IdP