Test WebAuthn registration and authentication flows. Inspect attestation objects, assertions, and credential details.
WebAuthn registration and sign-in ceremonies hand back binary CBOR structures that browsers and relying-party servers exchange but rarely show you directly. This debugger runs navigator.credentials.create() and .get() against the page it's loaded on, or accepts a pasted base64url attestationObject or assertion response, and decodes it: CBOR fields, the authenticatorData flag byte, RP ID hash, sign counter, and the attested credential's COSE public key. The most common surprise: attestation format 'none' with an empty attestation statement is the normal, expected result for platform passkeys, not a sign the ceremony failed.
A concrete input and expected output from the current implementation.
Input
authenticatorData flags byte: 0x5D
Expected output
UP=1, RFU1=0, UV=1, BE=1, BS=1, RFU2=0, AT=1, ED=0 -> User Present, User Verified, Backup Eligible, currently Backed Up, attested credential data included, no extension data
0x5D is binary 01011101; reading bit 0 as UP up through bit 7 as ED per the WebAuthn authenticatorData flag layout gives that exact set of true/false values.
A pasted or captured attestationObject is CBOR-decoded into fmt, attStmt and authData. authData is then split byte by byte into the 32-byte RP ID hash, the 1-byte flags field, the 4-byte signature counter, and, when the AT flag is set, the attested credential block (AAGUID, credential ID, COSE-encoded public key).
Given a challenge you supply, the tool calls navigator.credentials.create() or .get() in the current page context and reads back the resulting PublicKeyCredential: clientDataJSON (origin, challenge, type), and either the attestation response on registration or authenticatorData plus signature and userHandle on authentication.
Yes. Paste the base64url-encoded attestationObject, or the full response your server received, and the tool CBOR-decodes it directly. No navigator.credentials call is made in that mode, so it works for debugging logs after the fact.
Most synced passkeys (iCloud Keychain, Google Password Manager) report signCount as 0 on every assertion because a per-device counter is meaningless once a credential is copied across devices. Treat a persistently 0 counter as normal unless you're specifically testing a hardware security key.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.