# WebAuthn Passkey Assertion Decoder & Challenge Debugger

Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.

> Canonical page: https://elysiatools.com/en/tools/webauthn-passkey-assertion-decoder-challenge-debugger

- **Category:** Cryptography

- **Keywords:** webauthn, passkey, fido2, cbor, cose, assertion, challenge, authenticatorData, rpIdHash, es256, rs256, ed25519

## Overview

The WebAuthn Passkey Assertion Decoder & Challenge Debugger parses clientDataJSON and authenticatorData, inspects flags, rpIdHash, and signCount, checks challenge and origin bindings, and can verify supported signatures when a COSE public key is provided.

## Inputs

- **clientDataJSON** (textarea): {"type":"webauthn.get","challenge":"Y2hhbGxlbmdl","origin":"https://example.com"}
- **clientDataJSON 编码** (select)
- **authenticatorData** (textarea): a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce19478500000002
- **签名** (textarea): 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
- **二进制编码** (select)
- **期望 Challenge（base64url，可选）** (text): Y2hhbGxlbmdl
- **期望 Origin（可选）** (text): https://example.com
- **RP ID（可选）** (text): example.com
- **上一次 signCount（可选）** (number)
- **COSE 公钥（可选）** (textarea): Paste a CBOR COSE_Key or numeric-key JSON object to verify the signature.
- **COSE 密钥编码** (select)

## When to use

- Debug a failed WebAuthn or passkey assertion during sign-in.
- Check whether the received challenge, origin, and RP ID match expected values.
- Inspect authenticator flags and signCount, or verify a signature with a supplied COSE public key.

## How it works

- Enter clientDataJSON as JSON text or Base64url, then provide authenticatorData and the signature using hexadecimal or Base64url encoding.
- Optionally enter an expected challenge, expected origin, RP ID, and previous signCount for additional binding and counter checks.
- Optionally provide a COSE public key as Base64url CBOR, hexadecimal CBOR, or numeric-key JSON.
- Review the JSON result for decoded assertion fields, validation statuses, signCount information, and signature verification status.

## Use cases

- Investigate passkey login failures by comparing the received challenge and origin with server expectations.
- Review authenticatorData flags, RP ID hash, and signCount while diagnosing WebAuthn server implementations.
- Confirm assertion signatures with a supplied COSE public key during cryptography and FIDO2 testing.

## Frequently asked questions

### What does this tool decode?

It decodes clientDataJSON and authenticatorData, including challenge, origin, rpIdHash, flags, and signCount.

### Which clientDataJSON encodings are supported?

You can enter clientDataJSON as JSON text or Base64url.

### Which encodings are supported for authenticatorData and signatures?

Both authenticatorData and signatures can be entered as hexadecimal or Base64url.

### Can it check a challenge and origin?

Yes. Provide an expected challenge and expected origin to compare them with the assertion data.

### Can it verify the assertion signature?

Yes, when you provide a COSE public key. Supported algorithms include ES256, RS256, and Ed25519.

## Related tools

- [JWT Inspector & Verifier](https://elysiatools.com/en/tools/jwt-inspector-verifier): Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo
- [Hash Algorithm Comparator](https://elysiatools.com/en/tools/hash-algorithm-comparator): Hash the same input with MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE3 at the same time and compare them side by side: output length, hex/Base64 digest, security status (broken / modern), and a relative speed benchmark. Great for teaching, choosing a hashing algorithm, or sanity-checking checksums.
- [Distributed Trace Decoder & Waterfall Visualizer](https://elysiatools.com/en/tools/distributed-trace-decoder-waterfall-visualizer): Decode Jaeger, Zipkin, or OpenTelemetry trace JSON and render span timing, dependencies, and error hotspots as an interactive waterfall report
- [JWK Generator & Parser](https://elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata
- [package.json Dependency Auditor](https://elysiatools.com/en/tools/package-json-dependency-auditor): Audit a package.json for dependency hygiene, version-range quality, and optionally inspect a transitive dependency tree from package-lock.json or yarn.lock. Flags duplicates, wildcard or pre-release specs, unsorted keys, missing metadata, and misclassified runtime/dev dependencies.
- [Snowflake / Discord ID Bit Decoder](https://elysiatools.com/en/tools/snowflake-discord-id-bit-decoder): Decode 64-bit Snowflake-style IDs for Discord, Twitter, Mastodon, Sonyflake, Instagram, or a custom bit profile. Extract timestamp, worker/process/machine, sequence fields, align platform epochs, and infer a Discord shard when a shard count is supplied.
- [Excel Field-Level Decryptor](https://elysiatools.com/en/tools/excel-field-decryptor): Decrypt specific fields in Excel files using various decryption methods to restore encrypted information
- [Markdown Table to CSV JSON with Type Inferred Schema](https://elysiatools.com/en/tools/markdown-table-to-csv-json-schema): Convert a Markdown pipe table to CSV, JSON rows or an inferred JSON Schema with alignment and null diagnostics

## Samples

- [Grafana Advanced Application Samples](https://elysiatools.com/en/samples/grafana-samples): Comprehensive Grafana samples covering advanced dashboard design, alerting configurations, data source integrations, and plugin development
- [QR Code Samples](https://elysiatools.com/en/samples/qrcode-samples): Sample QR code images for testing QR code reading and generation tools
- [D3.js Data Visualization Samples](https://elysiatools.com/en/samples/d3js-data-visualization): Comprehensive D3.js data visualization examples including charts, maps, animations, and interactive visualizations
- [Rome JavaScript Toolchain Samples](https://elysiatools.com/en/samples/rome): Rome JavaScript toolchain examples including configuration, linting, formatting, bundling, and project management