DPNR passkey spike (throwaway)

Test pool only. No real accounts or data. The results panel never contains passwords, tokens or PRF secrets (only short SHA-256 fingerprints).

0. This device

1. Password sign-in

Email Password Authenticator code (only if asked)

Signed out.

2. Passkeys (signed in)

3. Passkey sign-in

4. Optional (S6): authenticator app on this test user

Code from the app

Results