Why it matters
Decodes passkey registration and login responses: clientDataJSON, authenticatorData flags, attestation and COSE keys.
Base64url input of credential JSON; CBOR decoder (shared with the batch 6 binary decoder); authenticatorData parser (rpIdHash check against a given RP ID via WebCrypto SHA-256, UP/UV/BE/BS/AT/ED flags); COSE key to JWK/PEM; assertion signature verification with WebCrypto when the public key is supplied. Attestation chains shown, not trusted. Everything runs in your browser; nothing you paste is sent unless you press Fetch.
How to use it
- Paste or type the input the tool asks for.
- Read the summary and the table or preview.
- Adjust the options if you need a different result.
- Copy or download the output. Nothing leaves this page.
FAQ
Is my input uploaded?
No. The work runs in your browser and nothing you type, paste or upload is sent anywhere.
Will this change my site for me?
No. It shows results and, where it writes rules or files, you copy them and apply them yourself.
Can I rely on this as official guidance?
It follows public documentation and well-known algorithms, and tells you where it is a subset or a simulation. Confirm critical changes in the official tool or a staging environment.
