Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Cryptography

WebAuthn Passkey Assertion Decoder & Challenge Debugger

· Last updated：2026-08-06

Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Cryptography
Input types
textarea, select, text, number
Output type
json
Sample coverage
4
API ready
Yes

Overview

The WebAuthn Passkey Assertion Decoder & Challenge Debugger parses clientDataJSON and authenticatorData, inspects flags, rpIdHash, and signCount, checks challenge and origin bindings, and can verify supported signatures when a COSE public key is provided.

When to use

  • Debug a failed WebAuthn or passkey assertion during sign-in.
  • Check whether the received challenge, origin, and RP ID match expected values.
  • Inspect authenticator flags and signCount, or verify a signature with a supplied COSE public key.

How it works

  1. 1Enter clientDataJSON as JSON text or Base64url, then provide authenticatorData and the signature using hexadecimal or Base64url encoding.
  2. 2Optionally enter an expected challenge, expected origin, RP ID, and previous signCount for additional binding and counter checks.
  3. 3Optionally provide a COSE public key as Base64url CBOR, hexadecimal CBOR, or numeric-key JSON.
  4. 4Review the JSON result for decoded assertion fields, validation statuses, signCount information, and signature verification status.

Use cases

  • Investigate passkey login failures by comparing the received challenge and origin with server expectations.
  • Review authenticatorData flags, RP ID hash, and signCount while diagnosing WebAuthn server implementations.
  • Confirm assertion signatures with a supplied COSE public key during cryptography and FIDO2 testing.

Examples

1. Inspect an assertion without signature verification

WebAuthn developer

Background

A developer needs to inspect a captured assertion and confirm its challenge binding and counter value before adding public-key verification.

Problem

The assertion fields need to be decoded while making it clear that the signature was not checked.

How to use

Enter clientDataJSON as JSON text, provide authenticatorData and the signature as hexadecimal, then set the expected challenge, RP ID, and previous signCount.

clientDataEncoding: json; binaryEncoding: hex; expectedChallenge: Y2hhbGxlbmdl; rpId: example.com; previousSignCount: 1

Outcome

The JSON result reports the challenge check, decoded assertion data, signCount 2, and a not-checked signature status.

2. Diagnose a mismatched WebAuthn challenge

Identity engineer

Background

An assertion contains the challenge Y2hhbGxlbmdl, but the server is testing it against a different expected challenge.

Problem

The engineer needs to identify a client/server binding mismatch quickly.

How to use

FAQ

What does this tool decode?

It decodes clientDataJSON and authenticatorData, including challenge, origin, rpIdHash, flags, and signCount.

Which clientDataJSON encodings are supported?

You can enter clientDataJSON as JSON text or Base64url.

Which encodings are supported for authenticatorData and signatures?

Both authenticatorData and signatures can be entered as hexadecimal or Base64url.

Can it check a challenge and origin?

Yes. Provide an expected challenge and expected origin to compare them with the assertion data.

Can it verify the assertion signature?

Yes, when you provide a COSE public key. Supported algorithms include ES256, RS256, and Ed25519.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Monitoring

Grafana Advanced Application Samples

Comprehensive Grafana samples covering advanced dashboard design, alerting configurations, data source integrations, and plugin development

Media

QR Code Samples

Sample QR code images for testing QR code reading and generation tools

Data Visualization

D3.js Data Visualization Samples

Comprehensive D3.js data visualization examples including charts, maps, animations, and interactive visualizations

Developer Tools

Rome JavaScript Toolchain Samples

Rome JavaScript toolchain examples including configuration, linting, formatting, bundling, and project management

Security

JWT Inspector & Verifier

Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo

Cryptography

Hash Algorithm Comparator

Hash the same input with MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE3 at the same time and compare them side by side: output length, hex/Base64 digest, security status (broken / modern), and a relative speed benchmark. Great for teaching, choosing a hashing algorithm, or sanity-checking checksums.

Development

Distributed Trace Decoder & Waterfall Visualizer

Decode Jaeger, Zipkin, or OpenTelemetry trace JSON and render span timing, dependencies, and error hotspots as an interactive waterfall report

Security

JWK Generator & Parser

Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata

Enter the assertion fields, set expectedChallenge to d3JvbmdjaGFsbGVuZ2U, and keep the RP ID set to example.com.

clientDataEncoding: json; binaryEncoding: hex; expectedChallenge: d3JvbmdjaGFsbGVuZ2U; rpId: example.com; previousSignCount: 1

Outcome

The JSON result marks the challenge check as fail, exposing the mismatch between the assertion and the expected value.

3. Verify a signature with a COSE public key

FIDO2 tester

Background

A tester has a WebAuthn assertion and its registered COSE public key and wants to validate the cryptographic signature.

Problem

The assertion must be checked against the supplied public key rather than only decoded.

How to use

Provide clientDataJSON, authenticatorData, and the signature, then paste the COSE public key and select its encoding.

coseEncoding: base64url; binaryEncoding: hex; provide a COSE CBOR public key

Outcome

The result includes the signature verification status alongside the decoded assertion fields and binding checks.