fakefido/ GitHub

A virtual authenticator demo

FIDO flows,
without the hardware.

FakeFido is a small command-line project for exploring FIDO2 and WebAuthn with a virtual USB device.

Built on BulwarkID’s Virtual FIDO ↗

Install on Linux

amd64 · arm64 · systemd

Requires root
terminal
curl -fsSL https://pub-7e86b3749663480cb15de05614bda9e4.r2.dev/latest/install.sh | sudo sh

Downloads are served from the public FakeFido release bucket.

Please read before using

This is not real WebAuthn security.

FakeFido is software, not a hardware authenticator. Credentials (often called passkeys) are stored in a local JSON vault file. There is no secure hardware protecting the keys, device-bound storage, or hardware-backed user verification.

That differs from passkeys protected by Apple or Android devices, and physical security keys such as YubiKeys. Do not use FakeFido to protect real accounts or sensitive data.

Using FakeFido

A few useful commands.

The Linux installer starts FakeFido as a system service. Check whether it is running or follow its logs with:

sudo systemctl status fakefido
sudo journalctl -u fakefido -f

For direct CLI use, start the virtual device with fakefido start. The CLI can also show saved identities, delete one by ID prefix, and configure PIN behavior:

fakefido list
fakefido delete --identity <id-prefix>
fakefido pin enable
fakefido pin disable
fakefido pin set --pin 1234

Use fakefido --help for all commands. When installed as a service, CLI commands use /var/lib/fakefido/vault.json even before it exists, so new credentials go into the service vault. The installer gives the user who ran sudo access to that vault and its passphrase, so commands like fakefido list work without sudo. Use --vault and --passphrase before the command to override the defaults. Without a service install, the CLI uses vault.json in the current directory.

Under the hood

A demo built on
Virtual FIDO.

FakeFido wraps BulwarkID’s Virtual FIDO repository, which implements a virtual FIDO2/U2F USB device. This project connects that library to a simple command-line demo and local credential vault.

It’s a place to learn, inspect the code, and experiment with test accounts. A virtual device cannot provide the physical isolation or assurances of an actual authenticator.

After installation, manage the systemd service with systemctl status fakefido and view logs with journalctl -u fakefido -f.

Curious about the implementation? Read the warning, then experiment with test accounts.

View FakeFido on GitHub ↗