Four unknowns, each answerable in one click. Run this on every device type you care about — the passkey answer is per-platform, not per-app.
Creates a throwaway passkey the first time, then reuses it on every later press. That reuse is the point: the question is not whether a passkey can produce key material once, it is whether the same passkey produces the same material every time, across reloads and across devices. A key that drifts is a budget nobody can open tomorrow.
Press it, reload the page, press it again — the fingerprint must not change. Then try it on another device signed into the same password manager: if the fingerprint matches there too, one passkey unlocks every device and there is nothing to enrol.
The passkey is scoped to finance.jaronwilson.dev,
not to this test host, so it will still work when the real app is there.
On a second device, press the first button.
Creating a passkey there makes a different credential, which produces
a different fingerprint whether or not anything synced — so it answers nothing
while looking like an answer. Compare the credential: line as well
as the fingerprint: two different ids mean two different passkeys.
not run
Wraps one data key with the PRF output and with a recovery code, encrypts a budget-shaped blob, then opens it both ways. Proves a lost passkey is not lost data.
not run
Needs a Google OAuth Web application client with this page's origin listed. Paste the client ID below. Writes a file to appDataFolder, reads it back, deletes it.
not run
The proxy is a Pages Function on this same origin, so there is no CORS and nothing to point at — the default path below is served by whatever is serving this page. Paste a SimpleFIN access URL, the one with credentials in it. Nothing is stored anywhere; this page keeps it in memory only, and the function has nowhere to write it.
not run