How to Use the WebAuthn Tool in Microsoft Edge DevTools to Emulate Virtual Passkeys and Security Keys

The web industry is rapidly transitioning toward passwordless authentication powered by WebAuthn (Web Authentication API) and FIDO2 passkeys. Implementing passkeys enhances security by substituting phishing-prone passwords with cryptographic public-private key pairs stored on hardware authenticators. However, developing and debugging WebAuthn registration and authentication flows using physical hardware (such as YubiKeys or platform biometric sensors like Windows Hello and Touch ID) is cumbersome. Resetting physical authenticators to test edge cases or testing multiple user accounts quickly becomes impractical.

Microsoft Edge DevTools includes a dedicated WebAuthn drawer tool that allows developers to create and control virtual, software-based authenticators with customizable cryptographic protocols, resident keys, and biometric simulation.

Opening the WebAuthn Tool in Edge DevTools

To access the WebAuthn testing interface:

1. Open Microsoft Edge and navigate to your application’s authentication page.
2. Press F12 or right-click anywhere and select Inspect.
3. Press Ctrl + Shift + P (Windows) or Cmd + Shift + P (macOS) to summon the DevTools Command Menu.
4. Type WebAuthn and select Show WebAuthn.
5. Alternatively, click the More tools menu (three dots beside Console in the lower drawer) and select WebAuthn.

Core Configuration Parameters for Virtual Authenticators

The WebAuthn drawer allows you to construct virtual authenticators tailored to match real-world hardware profiles:

Configuration Field	Available Options	Authentication Testing Role
Protocol	ctap2 (FIDO2) / u2f (CTAP1)	Selects between modern FIDO2 passkeys or legacy U2F security tokens.
Transport	usb, nfc, ble, internal	Simulates physical USB keys versus internal platform authenticators (Windows Hello).
Supports Resident Keys	Checkbox toggle	Enables discoverable credentials (passkeys where the user does not need to enter a username).
Supports User Verification	Checkbox toggle	Simulates biometric matching or device PIN entry required by high-security enterprise policies.
Supports Large Blob	Checkbox toggle	Tests reading and writing arbitrary data blobs associated with credential registrations.

Step-by-Step: Testing a Passkey Registration Flow

1. In the WebAuthn panel, check the box labeled Enable virtual authenticator environment.
2. In the “New authenticator” section:
   • Set Protocol to ctap2.
   • Set Transport to internal (to simulate platform passkeys).
   • Check Supports resident keys.
   • Check Supports user verification.
3. Click Add. A virtual authenticator appears in the panel with zero registered credentials.
4. On your web application, trigger your passkey registration button (which calls navigator.credentials.create()).
5. Instead of Windows Hello displaying a system prompt, Edge DevTools intercepts the call automatically. The WebAuthn panel instantly records the newly generated credential ID, user handle, and private key signature counter.

Testing Authentication and Edge Cases

Once credentials exist inside your virtual authenticator, you can test failure states:

• Simulate Failed Biometrics: Uncheck Is user verified in the active authenticator card, then attempt to log in. Verify that your application handles NotAllowedError exceptions gracefully.
• Test Signature Counter Mismatches: Manually increment or decrement the Counter value in the credential card to confirm your backend detects potential authenticator cloning attacks.
• Delete Credentials: Click the trash icon next to an individual credential to test how your app responds when a user removes a passkey from their authenticator.

Frequently Asked Questions

Do virtual authenticators persist after closing Edge DevTools?

No. When you close DevTools or uncheck “Enable virtual authenticator environment”, all virtual authenticators and simulated credentials are automatically purged from memory. Real platform authenticators (like Windows Hello) immediately resume handling WebAuthn calls.

Can I export simulated credentials to test across multiple browsers?

Yes. DevTools displays the base64-encoded Credential ID and User Handle directly in the credential card, which can be copied and verified against your server-side database.