WebAuthn Attestation Decoder
Decode a WebAuthn attestationObject — the CBOR map { fmt, attStmt, authData } returned during registration. Surfaces format, walks attStmt fields, and links into the authData and COSE Key tools.
How to use this tool
What it does
Decodes a WebAuthn/FIDO2 attestation object — its format, statement and authenticator data.
When to use it
Use it to verify what an authenticator claims about itself during registration, including its AAGUID.
Worked example
Decode an attestation object to read its fmt and the certificate chain in the statement.
Input
Decoded
About attestation
Attestation lets a relying party verify that a credential was generated on a particular make and model of authenticator. Most consumer flows skip attestation entirely (fmt: none); enterprise flows that require certified hardware verify the attestation signature and pin the AAGUID against the FIDO MDS BLOB. Attestation never reveals the user identity — it identifies the device, not the person.
Spec
WebAuthn Level 2 §6.5 / FIDO 2.0 attestation formats.
Companion tools
Frequently asked questions
What is in an attestationObject?
A CBOR map with three keys: fmt (the attestation statement format), attStmt (the format-specific signature and certificates) and authData (the authenticatorData bytes). Everything else is nested inside those.
Which attestation formats will I see?
packed is the most common for hardware authenticators, tpm for Windows platform credentials, android-key and android-safetynet on Android, apple on Apple platforms, and none when the relying party did not ask for attestation.
What does attestation actually prove?
That the credential was created by a genuine authenticator of a stated model. It says nothing about the user, and it is only produced at registration — later assertions carry no attestation.
Should a relying party require attestation?
Only when policy needs to restrict which authenticator models may enrol. It adds privacy considerations and metadata-verification work, so most consumer deployments request none.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.