The workbench / Interactive reference models
Small browser-only models for the kinds of production edge cases that are easier to understand when you can change the inputs yourself. Built as explainable exercises—not real security tests or claims about a deployed customer system.
iOS / Android / Backend
Change challenge age, replay state, signature verification, request binding, and assertion counters to see which server-side checks fail.
Mobile authentication
Trigger sign-in, expiry, refresh, revocation, and recovery. See permitted transitions and why recovery must not silently bypass step-up.
Backend / Reliability
Simulate an operation that commits after a client timeout, then change retry counts and deduplication to compare server-side side effects.