Passkey Payload Inspector
Decode and inspect WebAuthn / passkey payloads — AAGUID lookup, attestation object decoder, clientDataJSON parser, and a live Passkey Playground.
Paste an AAGUID (e.g. adce3619-3575-4043-9fd0-39a9c8702958) to identify the
authenticator.
Paste a PublicKeyCredential JSON response (from registration or authentication). The
full object or just the response field.
Paste the Base64URL-encoded clientDataJSON string. This reveals origin, challenge, and type — where most "Invalid Origin" auth failures hide.
PublicKeyCredential API. Try Chrome, Firefox, or Safari on a device with a biometric
or security key, served over HTTPS.
https:// or localhost). The Playground buttons are disabled.
Create and authenticate a passkey using your browser's built-in authenticator. The response is automatically decoded and shown in the WebAuthn Decoder tab.
Calls navigator.credentials.create() with the Passkey Playground as the relying
party. Your device will prompt for biometric or PIN.
Calls navigator.credentials.get() to assert an existing passkey. If you haven't
registered one above, your browser may show a blank list.
mediation: "conditional" to
credentials.get() to show passkeys inline in the username field's autofill dropdown.
FAQ
What is a passkey?
A passkey is a phishing-resistant credential based on the FIDO2 / WebAuthn standard. Instead of a password, the user's device generates a public/private key pair. The private key never leaves the device; the server stores only the public key. Authentication is done by signing a server-issued challenge with the private key.
What is an AAGUID?
The Authenticator Attestation GUID (AAGUID) is a 128-bit identifier embedded in a credential's attestation data that identifies the make and model of the authenticator (e.g. "iPhone Touch ID", "YubiKey 5 NFC", "Windows Hello"). It is used by relying parties to enforce authenticator policy.
What do the authData flags mean?
UP (User Present): the user physically interacted with the authenticator. UV (User Verified): the authenticator performed local user verification (PIN, biometric). BE (Backup Eligible): the credential can be synced. BS (Backed Up): the credential is currently backed up. AT: attestedCredentialData is present. ED: extension data is present.
Why does "Invalid Origin" cause authentication failures?
The origin embedded in clientDataJSON must exactly match the origin the server expects. A mismatch (e.g. http vs https, or a different port) causes the server's clientDataJSON verification to fail. The ClientDataJSON tab lets you inspect the exact origin that was captured during credential creation or assertion.
Is my credential data sent anywhere?
No. All decoding — Base64URL, CBOR, binary parsing — happens locally in your browser. No credential data, keys, or tokens are transmitted to any server.