Compatibility
A living, machine-probed WebAuthn/passkey support matrix rendered from the real, dated SoroPass matrix-pipeline snapshot, never hand-written.
Sourced, machine-probed, dated, and diffable: re-verified automatically, never hand-waved. This page renders the real exported snapshot from the matrix pipeline; nothing on it is typed by hand.
The matrix is generated by apps/matrix from MDN BCD ingest merged with a virtual-authenticator
CI run, then exported to dated JSON snapshots. Every cell carries its real source, tier, and
last-verified date, and unknowns render as ? instead of a fabricated green. Open the raw JSON
to verify that nothing here is invented.
Freshness
Each published snapshot carries a provenance stamp so you can see exactly how current it is:
- Built: the date the pipeline generated the snapshot, with its relative age (e.g. "today", "3 days ago").
- BCD: the MDN browser-compat-data version the pipeline ingested.
- Re-verified: the date of the virtual-authenticator CI run that fed the snapshot.
- Cells: the total number of feature × platform cells.
The eight platforms tracked in each snapshot are:
| Platform | Browser | OS |
|---|---|---|
| Chrome | Chrome | desktop |
| Chrome Android | Chrome | Android |
| Edge | Edge | Windows |
| Safari macOS | Safari | macOS |
| Safari iOS | Safari | iOS |
| Firefox | Firefox | desktop |
| Firefox Android | Firefox | Android |
| Samsung | Samsung Internet | Android |
Provenance
Every cell carries a tag for where it came from. A snapshot's cells break down by source, and the page shows the source mix as live counts straight from the snapshot. Current sources:
- ci: a virtual-authenticator CI probe (also covers live feature-detection probes).
- bcd: MDN browser-compat-data.
- passkeys.dev: the community passkeys.dev support tables.
- curated: hand-cross-referenced entries (e.g.
caniuse).
The page links the actual snapshot file produced by apps/matrix from MDN BCD merged with the
virtual-authenticator CI run. Open it: every glyph in the grid comes straight from the snapshot's
cells[] array, and unknowns render ? instead of a fake green.
How to read a cell
| Glyph | Meaning |
|---|---|
| ✓ | supported |
| ◐ | partial |
| ✕ | unsupported |
| ? | unknown |
Each cell also carries a source badge:
| Badge | Source |
|---|---|
| ci | virtual-authenticator CI |
| bcd | MDN BCD |
| passkeys.dev | passkeys.dev support tables |
| curated | hand-cross-referenced |
A cell is tier-1-automated only when the CI machine-verified it on that run (ci); everything else (BCD/curated cross-references and real-device sessions) is tier-2-manual. So Edge shows tier-1 only on a run that actually had it, and Safari/WebKit or Firefox evidence comes from dated real-device sessions rather than a fabricated green.
Clicking a cell reveals its detail: the feature and platform, the status, the source, the version it has been supported since, its tier, the last-verified date, any notes, and a link to the upstream source.
Support grid
The support grid is a table of every tracked feature (rows) against the eight platforms (columns). Each intersection renders a status glyph plus its source badge, drawn directly from the snapshot's cells[]. The grid highlights key features, including es256_alg (the ES256 algorithm SoroPass requires) and hybrid_transport.
CI grid: combinatorial proof
The CI grid is the combinatorial proof behind the support grid. It records the result of sweeping {transport × residentKey × UV} combinations on the CI runner, reporting for each combination whether the credential was created, asserted, verified, and which alg was negotiated. Each row is a real create → get round-trip checked with p256.verify.
| Column | Meaning |
|---|---|
| transport × residentKey × UV | the combination under test |
| created | credential creation succeeded |
| asserted | assertion (get) succeeded |
| verified | signature verified with p256.verify |
| alg | the COSE algorithm negotiated |
Limitations (a trust signal, not a footnote): platforms that are not available on the CI
runner are cross-referenced from BCD rather than machine-verified for that run. Firefox / WebKit
virtual authenticators remain out of scope; the CI sweep covers internal + usb transports with
a deterministic low-S signer, so it does not reproduce Apple's ~50% high-S distribution.
pnpm matrix:ci.Rebuilding the snapshot
If the page cannot load /matrix/index.json, regenerate and re-export the snapshot:
pnpm --filter @soropass/matrix matrix:build
DOCS_PUBLIC_DIR=apps/docs-fuma/public pnpm --filter @soropass/matrix docs:exportTesting
The @soropass/core/testing entry, covering createPasskeyKit mock mode, the deterministic mockAuthenticator, the zero-IO in-memory backend, and sampleAuthEntry for ready-made auth entries.
Security
How a passkey signs and a smart account verifies on-chain, plus the threat model for @soropass/core. Low-S, challenge binding, RP-ID/origin, and recovery, each backed by a test or a real on-chain proof.