CCob/okta-terrify

Pass-the-Passkey Family of Attacks

Bitwarden Passwordless.dev infrastructure/backend (API, database, Docker, etc).

AuthStrike is an identity and authentication security testing tool for controlled simulations, security research, and education purpose only. It helps security teams test Microsoft Entra attack paths such as device-code authentication, token handling, device registration, Microsoft Graph/Outlook access, and supported token-refresh flows.

Local-first WebAuthn conformance harbor - run passkey ceremonies against a matrix of relying-party scenarios, inspect challenge bytes and attestation formats, and render deterministic JSON reports. Go core, std-only, with a TypeScript browser lab.

FIDO2-certified passkey server

So, you think you have MFA? AAD/ROPC/MFA bypass testing tool

A simple site for testing Web Authentication

Proxy for enforcing webauthn authentication

OWASP PTK - application security browser extension.