WebAuthn Analyzer — decode and verify a ceremony's artifacts
Paste what a WebAuthn ceremony produced — from this debugger, from a relying party's console, or from the browser extension — and see what is actually in it. This page performs no ceremony, so it works against artifacts from any relying party, needs no authenticator, and needs no secure context. It is arithmetic over bytes you already have.
Accepted input: a PublicKeyCredential in its toJSON() form (registration or assertion), or a capture from the extension — which additionally carries the request options, the half a relying party never shows anybody.
What no page can show you. The browser mediates every ceremony: JavaScript receives these artifacts and never the authenticator. There is no private key here, no PIN, no biometric, no authenticator state, and no CTAP — not the commands, not the USB frames. That boundary is the reason WebAuthn resists phishing, and it is why this is a WebAuthn debugger and not a CTAP debugger.
