FIDO AAGUID lookup tool
An AAGUID identifies the make and model of a FIDO2 authenticator. Paste an AAGUID (canonical form or 32 hex characters) and this tool maps it to vendor and model from a curated offline directory. For production validation you should fetch the FIDO Metadata Service (MDS) BLOB.
How to use this tool
What it does
Maps a FIDO2 authenticator AAGUID to its make and model.
When to use it
Use it when an attestation carries an AAGUID and you want to name the authenticator, for policy or display.
Worked example
Paste an AAGUID from attested credential data to identify the authenticator model.
Input
Match
Browse the offline directory
Curated subset of well-known FIDO authenticators. The authoritative source is the FIDO Metadata Service BLOB — fetch and verify it for production attestation policy enforcement.
Spec
WebAuthn §5.4 / FIDO Metadata Service v3.
Companion
Pillar reading
Frequently asked questions
What is an AAGUID?
A 16-byte Authenticator Attestation GUID identifying the make and model of a FIDO2 authenticator — not the individual device. Every unit of the same model shares one AAGUID, which is what makes it usable for policy without identifying a user.
Where do I find the AAGUID for my authenticator?
It sits inside the attested credential data of authenticatorData at registration, immediately after the 4-byte signCount. Paste that structure into the authenticatorData parser and it will surface the AAGUID for you.
Why is my AAGUID all zeros?
A 16-byte zero AAGUID means the authenticator deliberately withheld its identity — the usual case for platform authenticators, or any registration requested with attestation set to none. It is expected behaviour, not an error.
Why is my AAGUID not in this directory?
This is a curated offline subset of well-known consumer and enterprise authenticators, not the full registry. For authoritative coverage a production relying party should fetch the FIDO Metadata Service BLOB and verify its signature.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.