WebAuthn Registration and Assertion Debugger

Inspect credential JSON, client data, authenticator flags, counters, attestation, and COSE evidence locally.

WebAuthn decoding is structural. The debugger does not enroll a credential, validate an origin server, or establish authenticator trust.

Credential JSONnavigator.credentials JSON shape

{
  "id": "fictional-credential",
  "type": "public-key",
  "response": {
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiZmljdGlvbmFsLWNoYWxsZW5nZSIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLmV4YW1wbGUudGVzdCJ9",
    "authenticatorData": "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "signature": "fictional-signature"
  }
}

Expected origin (optional)

Expected challenge (optional)

advisorywebauthn.signature_unverified · $.response.signature · The structural debugger has not verified the assertion signature or authenticator trust chain.

StatusReviewable

Typewebauthn.get

Originhttps://app.example.test

Flags

Credential reviewRaw credential bytes are summarized

{
  "status": "reviewable",
  "summary": {
    "credentialId": "fict…",
    "type": "webauthn.get",
    "origin": "https://app.example.test",
    "challengePresent": true,
    "clientDataKeys": [
      "challenge",
      "origin",
      "type"
    ],
    "authenticator": {
      "rpIdHash": "0100000000000000000000000000000000000000000000000000000000000000",
      "flags": [],
      "flagByte": 0,
      "signCount": 0,
      "extensionBytes": 0
    },
    "attestationFormat": null,
    "extensionKeys": []
  }
}