{"id":31946761,"url":"https://github.com/digitallyrefined/passkey-passwordless","last_synced_at":"2025-10-14T11:23:11.644Z","repository":{"id":220701592,"uuid":"752353167","full_name":"DigitallyRefined/passkey-passwordless","owner":"DigitallyRefined","description":"An example Passkey application showing how passwordless registration and authentication journeys work.","archived":false,"fork":false,"pushed_at":"2025-10-06T08:28:55.000Z","size":528,"stargazers_count":2,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-06T08:43:54.021Z","etag":null,"topics":["browser","fido","fido2","passkey","passkeys","passkeys-demo","typescript","webauthn","webauthn-demo"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DigitallyRefined.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":"FUNDING.yml","license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"liberapay":"DigitallyRefined"}},"created_at":"2024-02-03T17:31:10.000Z","updated_at":"2025-10-06T08:28:46.000Z","dependencies_parsed_at":null,"dependency_job_id":"dc809780-fc89-468e-ae46-b696da5a44e3","html_url":"https://github.com/DigitallyRefined/passkey-passwordless","commit_stats":null,"previous_names":["digitallyrefined/passkey-passwordless"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/DigitallyRefined/passkey-passwordless","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DigitallyRefined%2Fpasskey-passwordless","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DigitallyRefined%2Fpasskey-passwordless/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DigitallyRefined%2Fpasskey-passwordless/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DigitallyRefined%2Fpasskey-passwordless/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DigitallyRefined","download_url":"https://codeload.github.com/DigitallyRefined/passkey-passwordless/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DigitallyRefined%2Fpasskey-passwordless/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279019102,"owners_count":26086513,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["browser","fido","fido2","passkey","passkeys","passkeys-demo","typescript","webauthn","webauthn-demo"],"created_at":"2025-10-14T11:23:03.373Z","updated_at":"2025-10-14T11:23:11.638Z","avatar_url":"https://github.com/DigitallyRefined.png","language":"TypeScript","funding_links":["https://liberapay.com/DigitallyRefined"],"categories":[],"sub_categories":[],"readme":"# Passkey Passwordless\n\nAn example Passkey application showing how passwordless registration and authentication journeys work (via WebAuthn).\n\nIncludes progressive enhancement for devices that support saving usernames and keys (via resident storage), account management to add additional devices and fallback to magic email login links for devices that don't support (or cancel) WebAuthn.\n\nIncludes web frontend (nginx), API (Node/Express), Database (Mongo), and a Database viewer (Mongo Express).\n\n## Quick start\n\nPrerequisites: [Node](https://nodejs.org/) and/or [Docker](https://www.docker.com/) should be installed.\n\nThe app can either be started using Node or Docker:\n\n### Node\n\n1. `npm install`\n2. `npm start`\n\n\u003cdetails\u003e\n\u003csummary\u003eMissing `libcrypto.so.1.1`?\u003c/summary\u003e\n\nOn some systems if you're using Node only, you may encounter the following error:\n\n`StdoutInstanceError: Instance failed to start because a library is missing or cannot be opened: \"libcrypto.so.1.1\"`\n\nWhich can be resolved by installing [`libssl1.1`](https://github.com/nodkz/mongodb-memory-server/issues/480#issuecomment-1488548395):\n\n```bash\n# Debian/Ubuntu\nwget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb\nsudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb\n\n# RHL/Fedora\nsudo dnf install openssl1.1\n```\n\u003c/details\u003e\n\n### Docker\n\n`./start.sh`\n\n## Usage\n\n1. http://localhost:8000 to register and login\n2. Check the console output for the email confirmation links\n3. In Chrome, open \"DevTools \u003e Console \u003e More tools (hamburger menu) \u003e WebAuthn \u003e Enable virtual authenticator environment\" to try out different key types\n4. If Docker is installed check http://localhost:8081 for the user database\n5. Attempt to login from different devices, desktop vs. mobile\n6. Reset database via `npm run reset:db` (Docker only)\n7. Optionally set the SMTP settings in `apps.env` to send email and change `config.ts` to match your domain and security requirements\n\n## Browser support\n\n|      OS/Browser |  Android  |  Windows  |   iOS   |   macOS  | Linux  |\n| --------------: | :-------: | :-------: | :-----: | :------: | :----: |\n|          Chrome |   🐾🔑    |  🐾📲🔑  |    🛃   | 🐾📲🔑  |  📲🔑 |\n|          Safari |    ⛔     |    ⛔     |   🐾🔑 | 🐾📲🔑  |   ⛔   |\n|            Edge |   🐾🔑    |  🐾📲🔑  |    🛃   | 🐾📲🔑  |   🔑   |\n|         Firefox |   🐾🔑    |  🐾📲🔑  |    🛃   |    🔑   |   🔑   |\n| Chromium based* |    ⤵️     |   📲🔑    |   🛃   |  📲🔑   |  📲🔑  |\n\nKey:\n\n- 🐾 Platform authentication: such biometric login e.g. fingerprint, face unlock or PIN etc.\n- 📲 Roaming authentication: such as a mobile phone that can be setup via a QR to send a login confirmation prompt\n- 🔑 Security key: such as a YubiKey\n- 🛃 Assumed to work, as iOS prevents browser vendors from using their own engine (uses Safari under the hood)\n- ⛔ Not available\n\n### Notes on browsers tested\n\nSee [Can I use WebAuthn?](https://caniuse.com/?search=WebAuthn) for a full/up to date breakdown.\n\n#### Chrome 108\n\nSuccessfully registers and logs in, prompting for fingerprint (even if not signed into Chrome). Same for Microsoft Edge.\n\n#### Safari 16.1\n\nAllows touch ID only if iCloud is signed in, otherwise falls back to mobile QR code or security key.\n\n#### Firefox 107\n\nOn Windows Firefox supports Windows Hello (biometric login). On Android resident keys are not used, but users can still register and login with on device U2F. While on other platforms Firefox only allows security keys to used for registration and login.\n\n#### **\\*** ⤵️ Other Chromium based browsers\n\nDifferent Chromium based browsers may have different WebAuthn implementations. Some may have full support (such as Brave \u0026 Samsung Internet), partial or no support for WebAuthn.\n\n## Managing Passkeys\n\n### Android\n\nOpen \"Settings \u003e Passwords and accounts \u003e Google (under Passwords)\" tapping each login allows you to edit or delete it.\n\n#### As a linked security device/phone\n\nOn both Android and desktop in Chrome/Chromium based browsers navigate to \"Settings \u003e Privacy and security \u003e Phone as a security key/Manage phones\" to remove linked devices.\n\n### Windows\n\n#### Chrome/Chromium (108 \u0026 later)\n\n\"Settings \u003e Auto-fill \u003e Password Manager \u003e Manage passkeys\".\n\n#### Alternative method\n\n\u003cdetails\u003e\n\u003csummary\u003eVia Windows Terminal\u003c/summary\u003e\n\nTo view Passkeys stored by Windows Hello, from a command prompt, run:\n\n`certutil -csp NGC -key`\n\nPasskeys have names that look like `\u003csid\u003e/\u003cguid\u003e/FIDO_AUTHENTICATOR//\u003crpIdHash\u003e_\u003cuser id\u003e`\n\nYou need to identify the key that you want to delete, and then to delete a Passkey, from an administrator command prompt, run:\n\n`certutil -csp NGC -delkey \u003cname\u003e` Replacing `\u003cname\u003e` with the full pathname from the output of the command above.\n\u003c/details\u003e\n\n### macOS\n\n#### Chrome/Chromium (108 \u0026 later)\n\n\"Settings \u003e Auto-fill \u003e Password Manager \u003e Manage passkeys\". Chrome also allows users to edit the username, however this doesn't affect the login process since the resident key is identified by its public key ID.\n\n#### Safari\n\nPasskeys are managed under \"System Settings \u003e Passwords\". Click the i icon \u003e Edit and from here you can also \"Delete Passkey\". However, attempting to add password to a passkey System Settings will not let you save it.\n\n### YubiKey\n\n[YubiKey 5](https://support.yubico.com/hc/en-us/articles/360016649339-YubiKey-5C-NFC) and higher: use the [Yubico Authenticator app](https://www.yubico.com/products/yubico-authenticator/) (running as Administrator), clicking through to the WebAuthn settings and entering the keys passphrase to view stored keys. In Chromium based browsers on Linux, security keys can also be managed via \"Settings \u003e Privacy and security \u003e Security \u003e Manage security keys\".\n\nOlder YubiKeys (such as [U2F keys](https://support.yubico.com/hc/en-us/articles/360013656800-FIDO-U2F-Security-Key)) do not store resident keys and use a computed public/private key, as there's no data stored on the key.\n\n## See also\n\n- [WebAuthn.io](https://webauthn.io/)\n- [FIDO2 - FIDO Alliance](https://fidoalliance.org/fido2/)\n- [SimpleWebAuthn Project](https://github.com/MasterKale/SimpleWebAuthn)\n- [Can I use WebAuthn? - Browser support](https://caniuse.com/?search=WebAuthn)\n- [Google - Build your first WebAuthn app](https://developers.google.com/codelabs/webauthn-reauth)\n- [Bringing passkeys to Android \u0026 Chrome](https://android-developers.googleblog.com/2022/10/bringing-passkeys-to-android-and-chrome.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdigitallyrefined%2Fpasskey-passwordless","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdigitallyrefined%2Fpasskey-passwordless","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdigitallyrefined%2Fpasskey-passwordless/lists"}