A passkey never signs your Solana transaction directly. It signs <code>authenticatorData || SHA-256(clientDataJSON)</code>, where <code>clientDataJSON</code> is built by the browser: <code>{"type":"webauthn.get","challenge":"…","origin":"https://wallet.example"}</code> To prove that the challenge equals the transaction hash, a program has to receive the full <code>clientDataJSON</code> in instruction data and parse it. That publishes the exact origin, subdomain included, next to your public key. It also costs 100–200 bytes of a transaction that is capped at 1232 bytes.

Verifying the challenge on-chain means publishing the origin you signed on.

clientDataJSON puts the website on-chain

The 37-byte <code>authenticatorData</code> is part of the signed message, so it sits inside the precompile instruction: • <code>rpIdHash</code>: SHA-256 of the domain. Hash a list of likely wallet domains and compare. • flags: backup-eligible and backed up usually separate an iCloud or Google synced passkey from a hardware key. • <code>signCount</code>: synced passkeys report <code>0</code>, while hardware keys increment it. An increasing counter shows how often the key is used and orders your transactions across vaults.

rpIdHash, backup flags, and signCount are signed, so they go on-chain too.

authenticatorData fingerprints your device

Passkey wallets typically derive the vault as a PDA from the passkey, for example <code>seeds = ["passkey", sha256(pubkey)]</code> under the wallet program. Seeds and program code are public, so the mapping is too. Anyone who sees your passkey's public key, from a single transaction, a backend log, or a shared signature, can run <code>findProgramAddressSync</code> and get your vault address. From there they can read your balances and full history.

Vault PDAs are derived from public seeds, so anyone with the key can compute the address.