Description of the issue: I’m running into a persistent issue where Brave (and Chrome) automatically trigger the Windows Hello passkey dialog when signing into sites like office.com, even though every browser-side and system-side option related to passkeys or Windows Hello for the web is turned off. Edge does not show this behavior, so it appears specific to Brave and Chrome.
Even with browser password managers disabled, Windows Hello toggles in Chrome/Brave switched off, and Windows Hello configured only for local device login, the system still exposes the built-in Windows platform authenticator to Brave. Because device-level passkeys tied to Windows or Entra ID accounts cannot be removed, Brave keeps advertising Windows Hello as an available WebAuthn authenticator and forces the Hello dialog whenever a site supports passkeys. There is no way to suppress or disable this prompt, and it effectively overrides the intended login method, which in a business environment is especially problematic when users are supposed to rely on a dedicated password manager.
I’ve already tried essentially every angle: registry edits, group policies, all relevant Windows settings, browser flags, multiple accounts, multiple clean Brave/Chrome installations, and the issue reproduces 100% as long as the device has passkeys configured. Nothing so far disables Windows Hello as a platform authenticator without also breaking device login.
What I’m trying to understand is whether this is expected behavior, a missing feature, or a genuine bug. Is there any supported way to keep Windows Hello enabled for unlocking the device while preventing it from being offered to Brave as a passkey/WebAuthn option?
Steps to Reproduce (add as many as necessary): 1. Have Microsoft Hello passkey tied to an e-mail 2. navigate to office.com 3. try to log-in
Actual Result (gifs and screenshots are welcome!):
Thank you for reporting. We’ve logged the issue and will investigate. Please add any details that may be helpful for review in the below issue. Thanks again!
When Windows Hello is enabled, Windows exposes it to WebAuthn-capable browsers as a platform authenticator. Chrome and Brave do not have a supported mechanism to hide or disable this at the browser level. Settings related to passwords or passkeys mainly affect the browser’s password manager, not the WebAuthn interface, so Windows Hello can still be invoked by websites that support passkeys, including office.com.
Because the authenticator is provided by Windows, deleting browser data or stored passkeys does not remove it. As long as Windows Hello remains enrolled on the device, the operating system continues to advertise it to compatible browsers.
At present there is no documented, supported configuration that keeps Windows Hello for device unlock while fully preventing its use as a WebAuthn platform authenticator. Disabling Windows Hello enrollment (PIN / biometrics) is the only reliable way to stop the prompts system-wide.
