Is this passkey-based encryption secure?

Im working on a webapp and I'd like to be able to store encrypted data.

The data is stored on browser-storage with a custom hook: https://www.reddit.com/r/Frontend/comments/1ucu3ix/i_created_a_webcomponent_hook_for_encrypted

I added the ability to use passkeys to derive a password for the encryption key.

Support for passkeys is still a bit flaky between devices. My phone is fairly modern but passkeys PRF doesn't work. I considered in such a case to simply not offer passkey encryption, instead i decided to fallback to to using the credentialsID+HKDF as the password.

To have mechanism around recovery, I decided to use a crypto-random string as the password which would itself be encrypted by the passkey-derived password.

I was aiming for a seamless passwordless authentication for the user. You can try the demo here: https://enkrypted.chat

Let me know if there are details i might be overlooking. The project isnt completely open source, but feel free to reach out for clarity on the details.