What does this tool decode?

It decodes clientDataJSON and authenticatorData, including challenge, origin, rpIdHash, flags, and signCount.

Which clientDataJSON encodings are supported?

You can enter clientDataJSON as JSON text or Base64url.

Which encodings are supported for authenticatorData and signatures?

Both authenticatorData and signatures can be entered as hexadecimal or Base64url.

Can it check a challenge and origin?

Yes. Provide an expected challenge and expected origin to compare them with the assertion data.

Can it verify the assertion signature?

Yes, when you provide a COSE public key. Supported algorithms include ES256, RS256, and Ed25519.

Elysia Tools

Navigation

Cryptography

WebAuthn Passkey Assertion Decoder & Challenge Debugger

Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Prepared example runs

Click an example to fill the form automatically. File inputs still need an upload.

2 examples

Decode an assertion without a public key

Inspect challenge, origin, rpIdHash, flags, and counter while clearly reporting that cryptographic verification was not attempted.

{"result":{"checks":{"challenge":{"status":"pass"}},"signature":{"status":"not-checked"},"signCount":2}}

Diagnose a mismatched challenge

Use a deliberately different expected challenge to expose a replay or client/server binding mismatch.

{"result":{"checks":{"challenge":{"status":"fail"}}}}

Inputs

Options are grouped so long tools stay easier to scan.

11 options

ContentPaste or type the main input values.7

clientDataJSONtextareaRequiredauthenticatorDatatextareaRequired签名textareaRequired期望 Challenge（base64url，可选）textOptional期望 Origin（可选）textOptionalRP ID（可选）textOptionalCOSE 公钥（可选）textareaOptional

SettingsAdjust formats, ranges, numbers, and modes.4

clientDataJSON 编码selectOptional二进制编码selectOptional上一次 signCount（可选）numberOptionalCOSE 密钥编码selectOptional

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

WebAuthn Passkey Assertion Decoder & Challenge Debugger

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Inspect an assertion without signature verification

2. Diagnose a mismatched WebAuthn challenge

FAQ

Grafana Advanced Application Samples

QR Code Samples

D3.js Data Visualization Samples

Rome JavaScript Toolchain Samples

JWT Inspector & Verifier

Hash Algorithm Comparator

Distributed Trace Decoder & Waterfall Visualizer

JWK Generator & Parser

JSON Schema and API Contract Validation Tools

JSON Interchange and Format Translation Tools

JSON Inspection, Diff, and Transformation Tools

JSON Schema, Mock Data, and API Fixture Generators

3. Verify a signature with a COSE public key