WebAuthn Data Decoder
Free, private, runs entirely in your browser.
Loading tool...
What is WebAuthn Data Decoder?
The WebAuthn Data Decoder is a developer tool for inspecting the payloads produced by the Web Authentication API. When a user registers a passkey or security key, or signs in with one, the browser returns an object full of base64url-encoded binary structures. This tool decodes the clientDataJSON, the CBOR attestation object, the authenticator data flags, the attested credential and the COSE public key into readable fields, entirely client-side.
Key Benefits
- Turn unreadable base64url and CBOR blobs into structured, copyable fields
- Debug registration and authentication ceremonies without a backend
- Verify type, challenge, origin, RP ID hash and crossOrigin values
- Inspect flags and signCount for user presence, verification and clone detection
- Private by design - decoding happens locally, nothing is uploaded
Common Use Cases
- •Debugging a passkey registration that fails signature verification on the server
- •Checking which flags an authenticator actually set during login
- •Extracting the credential ID and public key for storing in your database
- •Comparing the challenge your server sent with the one in clientDataJSON
- •Building test fixtures and bug reports for FIDO2 integrations
How to Use the WebAuthn Data Decoder
- Capture a response: Call navigator.credentials.create() or navigator.credentials.get() in your app and serialize the result to JSON, keeping binary fields such as clientDataJSON and attestationObject base64url-encoded.
- Paste the JSON: Paste the whole response object into the input box. Both nested response objects and flat field maps are accepted.
- Click Decode: The tool detects the ceremony type automatically and decodes clientDataJSON, CBOR attestation data, authenticator flags and the COSE key locally in your browser.
- Inspect and export: Review the decoded fields, copy individual values with one click, or download the full decoded output as JSON for bug reports and test fixtures.
Key Features
- Decodes clientDataJSON: type, challenge, origin and crossOrigin
- Parses the CBOR-encoded attestationObject including fmt and attStmt
- Explains every authenticator data flag: UP, UV, BE, BS, AT and ED
- Extracts AAGUID, credential ID and the COSE public key (ES256, RS256, EdDSA)
- Shows userHandle and signCount for authentication debugging
- 100% client-side and offline - payloads never leave your browser
Frequently Asked Questions
What is the difference between a registration and an authentication response?
A registration response comes from navigator.credentials.create() and contains an attestationObject with the new credential and its public key. An authentication response comes from navigator.credentials.get() and contains authenticatorData plus a signature. The decoder detects which one you pasted automatically.
Is it safe to paste real passkey payloads into this tool?
Yes. All decoding happens locally in your browser with JavaScript - there are no network requests and nothing is uploaded. That said, payloads can contain origin and challenge values, so redact anything sensitive before sharing decoded output in public bug reports.
What do the UP, UV, BE and BS flags mean?
UP means the user was physically present, UV means the user was verified (biometric or PIN), BE means the credential is eligible for backup or sync, and BS means a backup is currently in use, such as a passkey synced via iCloud Keychain.
Why does my attestation format show as none?
Format none means the authenticator did not provide an attestation statement. This is normal for synced passkeys from iCloud Keychain or Google Password Manager, and also when the RP requested attestation: none during registration.
How is the challenge related to clientDataJSON?
The challenge is the base64url-encoded random bytes your server sent in the PublicKeyCredentialRequestOptions or CreationOptions. During verification your server must compare it byte-for-byte with the challenge inside clientDataJSON to prevent replay attacks.