FIDO AAGUID reference database
Curated AAGUID directory. Search by vendor, model, or AAGUID. Filter by vendor. Production should fetch the FIDO MDS BLOB for authoritative status.
AmbiSecure authenticators are not listed here. An AAGUID is assigned to a model through FIDO certification, and we publish ours once the registered value appears in the FIDO Metadata Service — a provisional or sample identifier in a reference table is indistinguishable from a real one, so we do not list one.
| AAGUID | Vendor | Model | Transports |
|---|---|---|---|
| cb69481e-8ff7-4039-93ec-0a2729a154a8 # | Yubico | YubiKey 5 Series | USB, NFC |
| ee882879-721c-4913-9775-3dfcce97072a # | Yubico | YubiKey 5 NFC | USB, NFC |
| fa2b99dc-9e39-4257-8f92-4a30d23c4118 # | Yubico | YubiKey 5 NFC | USB, NFC |
| 2fc0579f-8113-47ea-b116-bb5a8db9202a # | Yubico | YubiKey 5 USB-C | USB |
| 6d44ba9b-f6ec-2e49-b930-0c8fe920cb73 # | Yubico | Security Key NFC | USB, NFC |
| 149a2021-8ef6-4133-96b8-81f8d5b7f1f5 # | Yubico | Security Key | USB |
| b92c3f9a-c014-4056-887f-140a2501163b # | Yubico | Security Key | USB |
| c1f9a0bc-1dd2-404a-b27f-8e29047a43fd # | Yubico | YubiKey FIPS | USB |
| 42b4fb4a-2866-43b2-9bf7-6c6669c2e5d3 # | Titan Security Key v2 | USB, NFC | |
| 08987058-cadc-4b81-b6e1-30de50dcbe96 # | Microsoft | Windows Hello (TPM) | Platform |
| 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 # | Microsoft | Windows Hello hardware | Platform |
| 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 # | Microsoft | Windows Hello software | Platform |
| dd4ec289-e01d-41c9-bb89-70fa845d4bf2 # | Apple | iCloud Keychain (Managed) | Platform |
| fbfc3007-154e-4ecc-8c0b-6e020557d7bd # | Apple | iCloud Keychain | Platform |
| ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4 # | Google Password Manager | Platform | |
| 833b721a-ff5f-4d00-bb2e-bdda3ec01e29 # | Feitian | ePass FIDO USB-A | USB |
| ee041bce-25e5-4cdb-8f86-897fd6418464 # | Feitian | ePass FIDO NFC | NFC |
| 12ded745-4bed-47d4-abaa-e713f51d6393 # | Feitian | AllinPass FIDO2 | USB, NFC |
| 8876631b-d4a0-427f-5773-0ec71c9e0279 # | SoloKeys | Solo (Hacker) | USB |
| 8c97a730-3f7b-41a6-87d6-1e9b62bda6f0 # | SoloKeys | Somu | USB |
| d61d3b87-3e7c-4aea-9c50-441c371903ad # | Nitrokey | Nitrokey FIDO2 | USB |
| ab32f0c6-2239-afbb-c470-d2ef4e254db7 # | Token2 | T2F2 | USB, NFC |
| 0eb05afb-c0e8-4e3f-a5dc-f0fd3b6d5d52 # | OnlyKey | OnlyKey | USB |
What this reference covers
Spec
FIDO Metadata Service v3.
Companion tool
Reading
Primary sources
FIDO Metadata Service v3.0 · FIDO MDS overview · W3C WebAuthn Level 3
Usage notes
The AAGUID is only present when attestation is conveyed and the authenticator chooses to identify itself; platform authenticators often report an all-zero AAGUID for privacy. To map an AAGUID to a product name and its certification status, cross-reference the FIDO Alliance Metadata Service (MDS), which publishes authenticator metadata keyed by AAGUID.
- Do not treat the AAGUID as a per-user or per-device secret — it identifies a model, not an individual authenticator, and many devices share one.
- Enforce model policy against verified MDS metadata, not the self-reported AAGUID alone, unless attestation is validated.
- Look up an AAGUID with the AAGUID lookup tool and browse the curated directory by vendor and transport with the FIDO Metadata Explorer; certification and status come from the FIDO MDS itself.
Frequently asked questions
What is an AAGUID?
A 16-byte identifier for the make and model of a FIDO2 authenticator. Every unit of a model shares one, so it identifies a device type without identifying a user.
Why would an enterprise care about AAGUIDs?
Because they are how authenticator policy is expressed — allowing only approved models to enrol, and reporting on what is deployed across an estate.
Why is this a curated subset?
It covers well-known consumer and enterprise devices for orientation. The authoritative source is the FIDO Metadata Service BLOB, which is signed and should be fetched and verified in production.
What does an all-zero AAGUID mean?
The authenticator withheld its identity — normal for platform authenticators and for any registration requesting no attestation.
Where do I find the AAGUID in a registration?
Inside attested credential data in authenticatorData, immediately after the signature counter. The authenticatorData parser will extract it.