WebAuthn Attestation Decoder
Decode a WebAuthn attestationObject — the CBOR map { fmt, attStmt, authData } returned during registration. Surfaces format, walks attStmt fields, and links into the authData and COSE Key tools.
Input
Decoded
Paste attestationObject.
All decoding runs locally.
About attestation
Attestation lets a relying party verify that a credential was generated on a particular make and model of authenticator. Most consumer flows skip attestation entirely (fmt: none); enterprise flows that require certified hardware verify the attestation signature and pin the AAGUID against the FIDO MDS BLOB. Attestation never reveals the user identity — it identifies the device, not the person.
Spec
WebAuthn Level 2 §6.5 / FIDO 2.0 attestation formats.