authenticatorData parser for WebAuthn
Walk WebAuthn authenticatorData (§6.1). Splits rpIdHash | flags | signCount | AAGUID | credentialId | credentialPublicKey | extensions, and surfaces the BE / BS passkey state flags.
How to use this tool
What it does
Parses WebAuthn authenticatorData — the RP ID hash, flags, signature counter and attested credential data.
When to use it
Use it when validating a registration or assertion and you need each field of authenticatorData.
Worked example
Parse an authenticatorData blob to read the UP/UV flags and the credential's public key.
Input
Decoded
About authenticatorData
authenticatorData is a binary structure produced by the authenticator. It carries the RP ID digest (anti-phishing anchor), a flags byte (UP, UV, BE, BS, AT, ED), a 32-bit signature counter, and on registration the attestedCredentialData. The BE/BS flags are the load-bearing fields for distinguishing device-bound credentials from syncable passkeys.
Spec
WebAuthn Level 2 §6.1.
Companion
Reading
Frequently asked questions
What is authenticatorData?
The fixed-layout byte structure an authenticator signs on every ceremony: a 32-byte rpIdHash, a flags byte, a 4-byte signature counter, and — at registration only — attested credential data and extensions.
What do the flags mean?
Bit 0 is user present (UP), bit 2 user verified (UV), bit 3 backup eligible (BE), bit 4 backup state (BS), bit 6 attested credential data included (AT) and bit 7 extension data included (ED).
What is signCount for and why is it often zero?
It is a replay signal: a counter that should increase each assertion, so a relying party can spot a cloned authenticator. Many modern authenticators, particularly synced passkeys, keep it permanently at zero, so treat a static counter as normal rather than as evidence.
Why is there no AAGUID in my authenticatorData?
Because it is an authentication assertion rather than a registration. Attested credential data — which carries the AAGUID, credentialId and public key — is only present when the AT flag is set.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.