Live synthetic fixture renderer

Inspect the form.
Then inspect the refusal.

Move through all 12 deterministic phases in a real browser rendering surface. Each phase keeps the corpus markup intact and shows the exact password and OTP outcome an adapter is expected to report.

This is a manual renderer, not a password-manager benchmark or a compatibility result.

No real credentials. No submission. No network. The fixture runs in an opaque iframe sandbox without script execution, form submission, popups, downloads, or same-origin access. Its displayed synthetic.invalid URL is corpus metadata; the iframe does not adopt that origin.

Phase 1 of 12

Password-only step in a multi-step login

A current-password field remains a login target when the username was collected on an earlier page.

Rendered 01-current-password-step. Form submission is blocked by the iframe sandbox.

Expected observation

password-only-login
Password kind
login
Stored-password target
login-password
OTP kind
none
OTP targets
None

How to read it

Rendering and evidence stay separate.

Use the phase list to inspect browser parsing, labels, autocomplete tokens, field order, and DOM replacement. The expectation panel is the machine-readable contract; the sandbox is only its visual companion.

Deliberate limits

  • No password-manager extension is launched or evaluated.
  • No saved credential or generated OTP is requested.
  • No top-level or synthetic origin is emulated.
  • No cross-origin frame, hostile script, or closed shadow root is covered.

Read the corpus scope Download JSON Inspect source