Hello, I'd like to use this library but I'm concerned about the fact that the tokens are stored in plain text in the database. For their duration (by default, one hour) they are essentially passwords. I would have expected them to be hashed or at least encrypted before being stored in the database, like a password, no?

I imagine it's less of an issue because they're short-lived, but I guess if

To help debugging/reporting

Description

The Register tab on the debugger uses a string for the timeout instead of an unsigned long.

https://webauthn.me/debugger > publicKey.timeout
Docs: https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions

I see you have drfpasswordless in the settings.py
Is JWT something you'd be interested in adding to this project?