The "relying party" (the website you're trying to authenticate to) can request the browser to perform user verification and refuse to proceed without it. You'll

The "relying party" (the website you're trying to authenticate to) can request the browser to perform user verification and refuse to proceed without it. You'll need to type in your PIN then (or scan the fingerprint, or perform some other type of verification dance, whatever is supported by your device). The RP can also request not to perform it, but IME Chromium asks for PIN anyway. Firefox is not so insistent. You can play with parameters here (look for advanced settings): https://webauthn.io https://webauthn.io https://webauthn.me/debugger https://webauthn.me/debugger