Passkey / WebAuthn Debugger
Test passkeys in your browser and decode WebAuthn responses offline
Ceremony
This page is the relying party, so credentials are created for … only. Browsers block other RP IDs; use Decode response for responses from your own app.
Algorithms
Advanced
Test credentials
Kept in memory and forgotten when you leave the page. Passkeys stay in your authenticator; delete them in your passkey manager when you are done.
Summary
Details
What the WebAuthn Debugger does
Test passkeys and security keys in your own browser, decode WebAuthn responses captured from any application, and check what this browser supports. Live ceremony creates and uses test credentials with this site as the relying party. Decode response turns clientDataJSON, authenticator data, attestation objects and COSE keys into readable fields and runs the relying-party checks you would run on a server.
How to use it
- 1.Choose Live ceremony to register a test passkey and then authenticate with it, or Decode response to paste a response JSON from your app.
- 2.In Decode response, add the expected challenge, origin, RP ID, stored public key and previous counter if you have them.
- 3.Review the checks: errors first, then warnings, notes and passed checks.
- 4.Open Details for the decoded tree, the flags table, the JWK and the raw bytes, then copy the Markdown summary or export the decoded JSON.
Why live tests only work for this site
Browsers bind every credential to an RP ID that must match the page's domain. This page can only create and use credentials for its own domain, so it tests your browser, operating system, authenticator and passkey manager rather than your app. For your app, capture the response JSON your front end sends to the server and decode it here; decoding works offline for any RP ID.
Checks and signature verification
The checks cover the credential type, clientDataJSON type, challenge, origin, cross-origin use, RP ID hash, the UP, UV, BE, BS, AT and ED flags, the signature counter, the attestation format and the credential public key. Authentication signatures are verified with Web Crypto against a stored public key in JWK, COSE or SPKI PEM form, covering ES256, ES384, ES512, RS256, PS256 and Ed25519 where the browser supports it.
Privacy and limitations
Everything runs in your browser. Test credentials and pasted responses stay in memory and are not sent to CodingTool servers. Attestation statements and certificate chains are not verified and no FIDO Metadata Service (MDS) lookup is made, so the AAGUID is shown as is. This is a debugging aid, not a replacement for server-side WebAuthn verification.
