WebAuthn Debugger

Create and get passkey/WebAuthn credentials against the real browser API, then decode clientDataJSON, authenticatorData flags/signCount, and the CBOR-encoded attestationObject/COSE public key. Also decodes pasted base64url data without a live authenticator.

This browser does not expose the WebAuthn API (window.PublicKeyCredential is missing) — Create/Get won't work here, but the Decode tab still works on pasted data.

No credential created yet

Click Create credential — your browser/OS will prompt for a passkey (platform authenticator, security key, etc.).

Runs entirely client-side against the real browser WebAuthn API — nothing is sent to a server. Create/Get will prompt your OS/browser's own passkey UI (Windows Hello, a security key, etc.); this is a debugging aid, not a substitute for a real relying-party server, which must independently verify signatures and attestation server-side. If the ED flag is set on authenticatorData, any extension data trailing the credential public key is not split out from it (CBOR doesn't self-report byte length without full parsing) — the public-key decode above may then include or fail on that trailing data. This is uncommon for typical passkey flows.

WebAuthn Debugger

Create and get passkey/WebAuthn credentials against the real browser API, then decode clientDataJSON, authenticatorData flags/signCount, and the CBOR-encoded attestationObject/COSE public key. Also decodes pasted base64url data without a live authenticator.

Common uses

  • Create a passkey and inspect its attestationObject
  • Get an assertion and check the authenticatorData flags
  • Decode a pasted attestationObject from a server log

Also searched as

  • webauthn debugger online
  • decode attestationObject online
  • decode clientDataJSON
  • decode authenticatorData flags
  • cbor decoder online
  • cose public key decoder
  • test passkey registration in browser
  • navigator.credentials.create test
  • navigator.credentials.get assertion debug
  • inspect signCount passkey
  • decode base64url webauthn data

Frequently asked questions

How do I decode an attestationObject?

Use the Decode Pasted Data tab and paste the base64url value. The tool decodes the CBOR and shows authenticatorData and the COSE public key without needing a live authenticator.

How can I test creating a passkey in the browser?

The Create (Register) tab calls the real navigator.credentials.create API against your device or security key, then decodes the clientDataJSON, authenticatorData and attestationObject.

How do I check authenticatorData flags and signCount?

Run the Get (Assert) tab or paste data into Decode. The decoded authenticatorData shows its flags and the signCount.

What is the difference between create and get in WebAuthn?

Create registers a new credential (attestation) and get authenticates with an existing one (assertion). This debugger has a tab for each plus a decode-only tab.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.

Related tools