Passkeys in Action: A Hands-On Walkthrough with the Passkey Demo

Last time, I covered the why — passkeys, how they kill phishing, why they're faster than passwords, and where Linux still lags behind. That was the theory. This is the practice.

I built a live demo at passkey-demo.sandbox99.cc that lets you experience both auth methods side by side: the old way (password + TOTP) and the new way (passkey, one tap). No marketing fluff. No vendor lock-in talk. Just the actual UX difference, on your actual device.

Follow along. Create an account, try both flows, and tell me passwords don't feel obsolete after.

What the Demo Shows

Two login paths, one site:

The site is simple on purpose. No distractions, no extra features. The point is the auth experience — and how different the two paths feel when you're actually using them.

What you need:

• A browser (Chrome, Edge, Safari, Firefox — all work)
• A device with biometrics or a PIN (laptop fingerprint reader, phone Face ID, etc.)
• Five minutes

Platform Walkthroughs

Same site, same FIDO2 standard, different operating system wrapping. Here's what each one looks like.

macOS — Touch ID

The smoothest experience if you're on a MacBook.

Registration:

1. Visit the demo, create an account with any username and password
2. Go to Dashboard → "Create Passkey"
3. Safari/Chrome pops a Touch ID prompt — place your finger
4. Passkey created. You'll see it listed in your dashboard.

Login:

1. Visit the demo, click "Login with Passkey"
2. Touch ID prompt appears
3. Touch your finger
4. You're in. No password field. No TOTP code.

The whole login takes about 2 seconds. I've timed it against password + TOTP on the same machine — passkey is 4–6x faster, and that's with a short password I've memorized.

Cross-device bonus: If you created the passkey on your iPhone (via iCloud Keychain), your Mac can use it too. The Mac shows a QR code, you scan it with your phone, approve on the phone via Face ID, and the Mac logs in. Same passkey, synced across devices via iCloud. No extra setup needed.

iOS — Face ID

Works identically to macOS but with Face ID instead of Touch ID. The UX is the same because iCloud Keychain handles sync between them.

Registration:

1. Open Safari on your iPhone, visit the demo
2. Create an account, go to Dashboard → "Create Passkey"
3. Face ID animation appears
4. Done

Login:

1. Visit the demo, tap "Login with Passkey"
2. Face ID prompt
3. Look at your phone
4. Logged in

The cross-device flow (this is the impressive one): Say you created the passkey on your iPhone but you're on your Windows laptop. On the laptop's browser:

1. Click "Login with Passkey"
2. Choose "Use a different device"
3. A QR code appears on the laptop screen
4. Scan it with your iPhone camera
5. Approve on the iPhone with Face ID
6. The laptop logs in

Bluetooth enabled on both devices, both connected to the internet. Takes about 5 seconds. The private key never leaves your iPhone — it signs the challenge and sends the response back. The laptop never sees the key.

Android — Fingerprint / Face

Android's passkey support runs through Google Password Manager. Similar flow to iOS but with Google's ecosystem instead of Apple's.

Registration:

1. Open Chrome on Android, visit the demo
2. Create an account, go to Dashboard → "Create Passkey"
3. Fingerprint or face prompt from Android
4. Passkey saved to Google Password Manager

Login:

1. Tap "Login with Passkey"
2. Biometric prompt
3. Done

Cross-device works the same way: QR code on the desktop, scan with phone, approve biometrically. Google Password Manager syncs passkeys across your Android devices and Chrome instances.

Worth noting: Android 14+ lets you choose a third-party passkey provider instead of Google Password Manager. If you're using Bitwarden on Android, it can store your passkeys too — same FIDO2 standard, different storage backend.

Windows Hello — PIN / Fingerprint / Face

Windows 11 22H2+ has the deepest native passkey support on the Microsoft side.

Registration:

1. Open Edge or Chrome on Windows, visit the demo
2. Create an account, go to Dashboard → "Create Passkey"
3. Windows Hello dialog appears — choose PIN, fingerprint, or face
4. Passkey created and stored in the device TPM

Login:

1. Click "Login with Passkey"
2. Windows Hello prompt
3. Enter PIN, scan finger, or look at camera
4. Logged in

What's different here: Windows Hello stores passkeys in the device TPM (Trusted Platform Module). The private key is hardware-bound — it literally cannot leave the chip. If someone steals your hard drive, they can't extract your passkeys.

Edge 142+ also syncs passkeys to your Microsoft Account across Windows devices, so if you have a desktop and a laptop, your passkeys follow you. Windows 11 24H2 added a privacy consent prompt before passkey access — a small touch, but a good one for shared machines.

Linux caveat: If you're on Linux (like I am daily), there's no native OS passkey storage. You need Bitwarden or KeePassXC browser extensions. It works, but it's an extra step compared to the seamless experience on macOS, iOS, Android, and Windows. I covered this in detail in the previous post.

The Two Flows, Compared

Here's what the experience actually looks like when you're standing at the login screen:

Legacy: Password + TOTP

1. Click "Login"
2. Type username
3. Type password
4. Click "Submit"
5. Open authenticator app (or pull out phone)
6. Find the 6-digit code
7. Type the code before it expires
8. Click "Submit"

Time: 15–30 seconds (typing + switching apps + finding code)

What you need to remember: Password + where your TOTP codes live (authenticator app, phone, whatever)

What can go wrong: Password typo, TOTP expired, phone dead, authenticator app not synced, new device didn't transfer codes

Passkey

1. Click "Login with Passkey"
2. Touch fingerprint / look at camera / enter PIN
3. Done

Time: 2–4 seconds

What you need to remember: Nothing. The credential is bound to the site and your device.

What can go wrong: Device is locked, biometrics not enrolled (but that's a setup issue, not a login issue)

Side by side

Why It's Secure (Without the Code)

The demo doesn't use passwords for passkey logins — at all. Here's what happens behind the scenes, explained without a single code snippet:

Origin binding kills phishing

Your browser enforces which site can use which passkey. A passkey registered for passkey-demo.sandbox99.cc will never be offered to a phishing site. This isn't a policy or a warning — it's enforced at the protocol level. The browser literally will not present the credential to the wrong domain.

Compare that to passwords, where the only defense is you reading the URL bar correctly.

No shared secrets

When you register a passkey, the server stores your public key. That's it. If the server gets breached, attackers get public keys — which are useless without the corresponding private key sitting on your device.

With passwords, a breach means hashed passwords. With TOTP, it means TOTP secrets. With passkeys, it means nothing actionable.

Challenge-response prevents replay

Every login generates a fresh, random challenge from the server. Your device signs it with the private key. The server verifies the signature. Even if someone intercepts the response, they can't reuse it — the next login uses a different challenge.

Biometric gating

The private key sits encrypted on your device. To use it, you must authenticate — fingerprint, face, or PIN. Someone who steals your laptop can't use your passkeys without your biometric. Someone who clones your session token can't create new passkeys without your biometric.

Security Comparison — The Full Picture

This is the table from the previous post, updated with the demo as a concrete reference:

NIST SP 800-63B is unambiguous: passkeys qualify as phishing-resistant authentication. SMS and TOTP codes explicitly do not. That's not opinion — it's the standard.

Try It Yourself

1. Go to passkey-demo.sandbox99.cc
2. Register with any username and password
3. From the Dashboard, click "Create Passkey"
4. Approve the biometric prompt
5. Log out
6. Click "Login with Passkey"
7. Approve the biometric prompt
8. Notice how different that felt

Then try the legacy path too — enable TOTP from the Dashboard, scan the QR code, and log in with password + code. Feel the friction. That friction is what passkeys eliminate.

Bonus exercise: Try cross-device. Create the passkey on your phone, then log in from your laptop by scanning the QR code. That's FIDO2 cross-device auth — the same standard that makes passkeys portable across ecosystems.

What This Proves

Passkeys aren't a concept. They're not a vendor pitch or a standards-body wish list. They're a working technology that ships in every major browser and operating system, right now.

The demo shows two things clearly:

• Passkeys are faster. Two seconds versus twenty. No contest.
• Passkeys are stronger. Phishing-resistant, no shared secrets, origin-bound, biometric-gated. Every security dimension improves.

The only reason not to use passkeys is if a site doesn't support them yet. That's changing fast — GitHub, Google, Apple, Microsoft, and most major services already do. The sites that don't will catch up because the user experience is too good to ignore.

Start with your most important account. Your Google, Apple, or Microsoft account is the best first passkey you'll ever create. Everything else follows.

The password era is ending. Go tap your fingerprint and feel the difference.