Kunzisoft / Kunzisoft/KeePassDX
Passkey authentication consistently failing cross-device authentication on Windows
- Dominant language
- Kotlin
- Stars
- 7.3k
- Forks
- 401
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 1
Description
Passkeys I create and store in KeePassDX consistently fail to authenticate with the cross-device flow on Windows. (I.e. [hybrid transport](https://www.corbado.com/blog/webauthn-passkey-qr-code), where you scan a QR code on your phone and connect to the PC over the internet).
Test case:
1. Go to webauthn.io on a Windows PC with Bluetooth support
2. Enter a username and click "Register"
3. When prompted where to save your passkey, click "iPhone, iPad, or Android device"
4. Scan the QR code that appears
5. On your phone, select KeePassDX as your credential provider
6. Success
7. Now, on the Windows PC on webauthn.io click "Authenticate"
8. Scan the QR code with your phone and unlock KeePassDX
9. Get error "Authentication failed: Could not verify authentication signature"
Bonus test case:
10. Open webauthn.io on your phone and click "Authenticate"
11. Unlock KeePassDX
12. Success
Also confirmed the same thing happens with Github. It does not happen when storing passkeys in Google Password Manager.
### Describe what you expected to happen:
Authentication should succeed.
### KeePassDX version:
4.4.3
### Build:
Libre
### Database version:
_No response_
### File provider (`content://` URI)
_No response_
### Android version:
16
### Android device:
Pixel 10 Pro
### Debug logs
* [console-export-2026-6-11_15-25-10 - KeePassDX.log](https://github.com/user-attachments/files/28855411/console-export-2026-6-11_15-25-10.-.KeePassDX.log) - Chrome console log of me registering on WebAuthn.io over hybrid transport with KeePassDX and attempting to authenticate
* [console-export-2026-6-11_15-26-14 - Google Password Manager.log](https://github.com/user-attachments/files/28855412/console-export-2026-6-11_15-26-14.-.Google.Password.Manager.log) - Chrome console log of me registering on WebAuthn.io over hybrid transport with Google Password Manager and attempting to authenticate (this succeeds)
Contributor guide
Research direction
Start with the attached Chrome console logs and the KeePassDX credential-provider flow used for WebAuthn hybrid transport on webauthn.io. Compare the failing KeePassDX registration/authentication logs with the successful Google Password Manager logs, then verify that cross-device authentication succeeds on Windows and GitHub while the phone-only case remains successful.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100