usefulweb.site Passkey & WebAuthn Tester

Security & supply-chain explorers

Passkey & WebAuthn Tester

Test passkeys in your browser and decode WebAuthn responses: flags, AAGUID, signatures.

From navigator.credentials.get(). Ignored when an attestationObject is given.

Try an example: Registration with packed self-attestation (synthetic software key) · Sign-in (assertion) with signature check

How it works

Checks which passkey features your browser offers, runs a real passkey registration and sign-in against this site, and decodes the result: authenticator flags (user present/verified, backup), AAGUID, key algorithm and transports. Paste clientDataJSON, attestationObject or authenticatorData to decode and verify them on the server.

  • In the browser (JavaScript on): feature detection of PublicKeyCredential, isUserVerifyingPlatformAuthenticatorAvailable(), isConditionalMediationAvailable() and getClientCapabilities(); then navigator.credentials.create() and get() with this site as relying party (rp.id = the current host) and random challenges generated in the browser. Nothing is sent to or stored on the server; the browser verifies the sign-in signature with WebCrypto.
  • clientDataJSON is decoded and checked: type (webauthn.create / webauthn.get), challenge, origin and crossOrigin. The RP ID hash in the authenticator data is compared with SHA-256 of the expected RP ID (or of the origin host).
  • Authenticator data (WebAuthn §6.1): RP ID hash, flags UP/UV/BE/BS/AT/ED, signature counter, and, at registration, the AAGUID, credential ID and COSE public key (decoded with a strict CBOR decoder). Well-known AAGUIDs are named from a small bundled list.
  • Attestation: "none" carries no statement. "packed" self-attestation (no certificate) is verified with the credential key; "packed" with an x5c certificate is verified with the certificate key, but the certificate chain is NOT validated against FIDO Metadata Service roots, so it proves nothing about the authenticator model. Other formats (tpm, android-key, apple, fido-u2f, …) are decoded but not verified.
  • Sign-in: the signature over authenticatorData ‖ SHA-256(clientDataJSON) is verified when you also paste the credential public key (COSE, base64url).

The browser test creates a real passkey for this site on your device or password manager; delete it there afterwards ("usefulweb.site passkey test"). This tool does not validate attestation certificate chains.

Sources

For scripts and AI agents

  • JSON API: POST https://passkeywebauthntester.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://passkeywebauthntester.usefulweb.site/mcp · tool name passkey_webauthn_tester
Example request
curl -s -X POST https://passkeywebauthntester.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • Hash & HMAC Calculator – MD5, SHA-2, SHA-3, BLAKE2, CRC32 and HMAC of text or files, with checksum compare.
  • Unicode Inspector – Every code point with name, script and bytes, plus hidden characters and look-alikes.
Feedback