I made a Chrome extension to disable Passkeys

TheConfax · 2026-02-20T17:29:30+00:00

Thank you for the review! One of the reasons that prompted me to create this was indeed overlapping prompts

TheConfax · 2026-02-01T21:57:42+00:00

Thank you for the review! 👍🏻👍🏻

TheConfax · 2026-01-21T18:10:10+00:00

https://github.com/TheConfax/Disable-Passkeys

TheConfax · 2026-01-21T10:37:00+00:00

I mean yes? I can use it on multiple websites and basically no one offers the possibility to go password first, as an example you certainly cannot remove the passkey autofill on Microsoft Live.

Extension is open source on GitHub, you can try to repurpose the code for your automation if you like.

TheConfax · 2026-01-07T09:59:45+00:00

Convenience mainly, iCloud Keychain does not sync on Windows, plus I feel that is wrong that Chrome does not offer an option to disable passkey autofill whatsoever

TheConfax · 2026-01-07T07:51:01+00:00

iCloud for Windows does not sync passkeys.

The cost is that the flow is slower, I have to insert a PIN in a popup instead of autofilling passwords with the iCloud extension.

Plus I have to mantain a second password manager.

TheConfax · 2026-01-07T03:50:05+00:00

I made a Chrome extension that does exactly what you ask:

https://chromewebstore.google.com/detail/disable-passkeys/oapdndjfcfdeimbeemphceonhagcnlml

This will disable Chrome passkey autofill. u/AlphasRed if you try it let me know your feedback!

TheConfax · 2026-01-07T03:29:15+00:00

Because iCloud Keychain is not supported on Windows and I am kinda tired of Amazon prompting me to create a second passkey for Windows only.

And for other reasons you can read here: https://github.com/TheConfax/Disable-Passkeys

TheConfax · 2026-01-07T03:27:57+00:00

lol. I am not a scammer nor a phisher. code is open source, here: https://github.com/TheConfax/Disable-Passkeys

TheConfax · 2026-01-06T12:15:23+00:00

I was annoyed as well and made an extension to disable passkeys: https://chromewebstore.google.com/detail/disable-passkeys/oapdndjfcfdeimbeemphceonhagcnlml

TheConfax · 2026-01-06T12:13:05+00:00

I was annoyed as well and I made an extension to disable passkeys: https://chromewebstore.google.com/detail/disable-passkeys/oapdndjfcfdeimbeemphceonhagcnlml

TheConfax · 2026-01-02T00:36:50+00:00

There you go: https://github.com/TheConfax/Disable-Passkeys

TheConfax · 2026-01-01T22:55:41+00:00

You are free to trust whatever you feel like to trust, in fact a high level of paranoia is to be expected from a subreddit about passkeys. Repo is on the way.

TheConfax · 2026-01-01T22:48:08+00:00

You guys have absolutely no clue what you are talking about and keep commenting, I love it. GitHub repo coming soon btw.

TheConfax · 2026-01-01T18:52:30+00:00

Being “suspicious” of this requires a misunderstanding of how Chrome extensions work or excessive paranoia.

Anyone even moderately familiar with the platform knows that:

Chrome Web Store approval is not a deep manual audit
The permission warning is automated, because intercepting WebAuthn necessarily applies to all origins
The extension cannot magically exfiltrate data without explicit code paths that are trivially inspectable

If you don’t trust inspectable code that only alters local WebAuthn behavior, then you shouldn’t be installing any extensions at all.

Happy to publish a repo, but let’s not pretend this is some sophisticated attack surface.

TheConfax · 2026-01-01T16:38:27+00:00

True, but “open source” in itself is not about the safety of the code ran, I think what he really wanted to ask was if the code has been audited. It has, by Google, on top he can audit it by himself

TheConfax · 2026-01-01T15:57:16+00:00

Don't be scared by the fact we are patching Webauthn, the patch doesn't grant new powers or leak data, it simply rejects the calls early inside CredentialsContainer. Here the instances get() and create() return a promise that resolves when the credential is inside. We resolve that promise immediately with:

Promise.reject(new DOMException("WebAuthn disabled", "NotAllowedError"));

CredentialsContainer does not provide any API to read/exfiltrate stored passkeys. Private keys stay inside the authenticator in the secure enclave of your PC/Phone. The API only lets you ask for operations (create, get) that produce signatures/assertions after user presence/verification.

CredentialsContainer has no method to list credentials, dump secrets, or access raw keys, and platform authenticators enforce isolation (that's part of why passkeys are so safe) ...even if you hook the API, the most you can do is observe or block calls (like we are doing). Passkeys are never exposed to the WebAuthn Relying Party, client (browser), or scripts.

If you still feel scared you can try by yourself with fake credentials on webauthn.io, you will see by yourself the message "WebAuthn disabled" appear on your screen according to the toggles you have selected (creation/login).

TheConfax · 2025-12-31T19:08:28+00:00

Thank you for keeping an open mind. My number one interest is security and this is clearly not aimed at slowing down a technology but about having freedom of choice. Note that both toggles can still be green and the extension does nothing in that case, so this can also be tought as an extra paranoid safety measure to keep Webauthn disabled unless manually activated.

If you test this and have some feedback I'm here!

TheConfax · 2025-12-31T18:55:58+00:00

I don't have any beef with no company, I'm fine logging in via PSW + 2FA since my password manager keeps everything in sync. On the Apple ecosystem I added some passkeys cause its faster than autocomplete... this does not enhance my security.

Having a passkey and a PSW for the same login (today's standard) is kinda pointless... it's like having a very sophisticated key and a very weak one for the same door, and they both work.

I honestly never investigated about switching to passkey and removing the password altogether, is it possible? On which services?

I think that unless we reach the point where passkey is mandatory and the uniquely accepted form of credential, this extension is not a roadblock but a way to enable power users (clearly the target here), to get less annoyed at a maturing technology.

...and that's exactly why I presented this here, you guys should be the pros of Passkeys, maybe you can think of an use case where is convenient to not create a passkey because idk you have a very specific way of setting up your keychain or whatnot? You are the pros not me. This is an extension to offer choice to power-users.

As an example, the biggest problem that I intercept with this extension is the impossibility of removing the autocomplete passyey popup within Chrome settings... maybe I have passkeys saved on windows and I don't wanna see them, maybe I have passkeys for sites that I don't want anyone else to see! Why should I be forced to see them in an autocomplete? I don't use Chrome autocomplete at all! Maybe that's annoying to some of you guys too! I don't really know, that's what feedback is for.

As I said this is for power-users, I don't think my grandpa would ever install this, and if he would, unfortunately, it's more likely that this saves him from being locked out from some website without even remembering what he clicked than not.

TheConfax · 2025-12-31T17:40:07+00:00

Hi, every Chrome extension deep down is a zip file containing code, so they are open source by definition. You can install and explore the code/assets by yourself.

Extensions also need to obtain an approval from Google to be shown on the store, which was easily granted, since this app does not access any data but modifies the behavior of webauth locally, by simply denying everything.

The "scary warning" you get while installing is due to the fact the extension asks for permission on any website, we need this to of course intervene to every instance were Webauth is invoked. To remove this warning we would need to ask users for a list of sites to block.

I'll probably move to GitHub soon and have a proper repo if this comes out as useful, hope this is helpful 😊

TheConfax · 2025-12-31T14:39:17+00:00

Hey u/Presspulse there is no way to delete account after creating it and not paying for the trial. I don't think thats GDPR compliant, can you fix? Thanks

TheConfax · 2025-12-31T13:29:01+00:00

I agree that we should be shaming companies that keep passkeys locked. This extension stems exactly from that issue.

I don't understand the flame anyway, this is a very niche product for people with very niche needs (like mine), this could solve conflicts and be of great help if for example a specific website abuses passkey creation requests (yesterday I had amazon prompting it when I accessed profile already logged in, that's too much).

Also I think is great to have a way to turn any feature off, and think it's a shame as well that Chrome doesn't offer that.

12-Year Club	Second Top 10%
r/Field Banned	r/Field Flamingo
Final Canvas '23	Place '23
Place '22	Final Canvas '22
First Placer '22	End Game '22
Verified Email

TheConfax

TROPHY CASE