Souus Tools
Sponsor

Crypto & Hash

WebAuthn and Passkey Credential Debugger

Inspect WebAuthn credential JSON, client data, authenticator flags, attestation CBOR, COSE keys, counters, and assertion fields offline.

Free to use No sign-up Runs in your browser

Tool workspace

Inspector, not verifier. This tool parses supplied bytes but does not verify a challenge, origin, RP ID hash, attestation trust chain, or assertion signature. Do not use its output as an authentication decision.
Parsing happens locally in this browser tab. Credential data is not uploaded or retained.

Browser JSON serialization must preserve ArrayBuffer fields as Base64url strings, as returned by common WebAuthn JSON helpers.

What can a WebAuthn credential inspector reveal?

WebAuthn registration and authentication responses combine JSON with Base64url-encoded binary structures. This debugger exposes the client challenge, origin and ceremony type, the authenticator's RP ID hash, signature counter and UP, UV, BE, BS, AT, and ED flags. It also decodes CBOR attestation objects and COSE public-key metadata. Parsing helps diagnose integrations, but only a server-side WebAuthn verifier can enforce the challenge, relying-party policy, attestation trust, and signature.

How to inspect a passkey response safely

  1. 1Select complete PublicKeyCredential JSON or a specific Base64url-encoded WebAuthn binary field.
  2. 2Paste the captured registration or assertion data without changing its Base64url characters or binary order.
  3. 3Inspect clientDataJSON for challenge, origin, type, and cross-origin metadata expected by the relying party.
  4. 4Review authenticator flags, signCount, RP ID hash, attestation format, credential ID, and COSE key algorithm.
  5. 5Use a maintained server-side WebAuthn library to verify every security-sensitive field and signature.

Common passkey debugging tasks

Diagnose ceremony mismatches

Compare the decoded challenge, origin, and webauthn.create or webauthn.get type with values issued by the relying-party server.

Inspect authenticator capabilities

Read user-presence, user-verification, backup eligibility, backup state, attested-data, and extension-data flags from raw authenticator bytes.

Review registration key metadata

Extract credential ID, AAGUID, COSE key type, curve, and algorithm before storing a registration response or debugging interoperability.

Frequently asked questions

Does this tool verify a passkey login?

No. It never compares the challenge, origin, or RP ID with trusted server state and does not verify attestation certificates or assertion signatures. Use a WebAuthn server library.

What do UP, UV, BE, and BS mean?

UP records user presence, UV records user verification, BE marks a backup-eligible credential, and BS reports its current backup state. Policy decisions belong on the server.

Why can signCount be zero?

Some authenticators do not maintain a signature counter, and synchronized passkeys may not provide a useful monotonic value. Servers should follow current WebAuthn guidance rather than treating zero alone as failure.