WebAuthn Debugger

Create and get passkey/WebAuthn credentials against the real browser API, then decode clientDataJSON, authenticatorData flags/signCount, and the CBOR-encoded attestationObject/COSE public key. Also decodes pasted base64url data without a live authenticator.

This browser does not expose the WebAuthn API (window.PublicKeyCredential is missing) — Create/Get won't work here, but the Decode tab still works on pasted data.

No credential created yet

Click Create credential — your browser/OS will prompt for a passkey (platform authenticator, security key, etc.).

Runs entirely client-side against the real browser WebAuthn API — nothing is sent to a server. Create/Get will prompt your OS/browser's own passkey UI (Windows Hello, a security key, etc.); this is a debugging aid, not a substitute for a real relying-party server, which must independently verify signatures and attestation server-side. If the ED flag is set on authenticatorData, any extension data trailing the credential public key is not split out from it (CBOR doesn't self-report byte length without full parsing) — the public-key decode above may then include or fail on that trailing data. This is uncommon for typical passkey flows.

WebAuthn Debugger

Create and get passkey/WebAuthn credentials against the real browser API, then decode clientDataJSON, authenticatorData flags/signCount, and the CBOR-encoded attestationObject/COSE public key. Also decodes pasted base64url data without a live authenticator.

Common uses

  • Create a passkey and inspect its attestationObject
  • Get an assertion and check the authenticatorData flags
  • Decode a pasted attestationObject from a server log

Frequently asked questions

Can I use WebAuthn Debugger to create a passkey and inspect its attestationObject?

Yes. WebAuthn Debugger can create a passkey and inspect its attestationObject, directly in your browser.

Can I use WebAuthn Debugger to get an assertion and check the authenticatorData flags?

Yes. WebAuthn Debugger can get an assertion and check the authenticatorData flags, directly in your browser.

Can I use WebAuthn Debugger to decode a pasted attestationObject from a server log?

Yes. WebAuthn Debugger can decode a pasted attestationObject from a server log, directly in your browser.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.

Related tools