COSE Key Inspector
COSE_Key (RFC 8152) is the format WebAuthn uses for credentialPublicKey. Paste a CBOR map and this tool surfaces kty / alg / crv / x / y (or n / e for RSA) with field-by-field meaning.
How to use this tool
What it does
Decodes a COSE_Key (RFC 8152) CBOR map — the format WebAuthn uses for a credential public key.
When to use it
Use it when verifying a WebAuthn registration and you need the key type, curve and coordinates.
Worked example
Paste the credentialPublicKey CBOR to read kty, alg and the x/y coordinates.
Input
Decoded
About COSE_Key
COSE_Key is a CBOR map keyed by small integers: 1=kty, 2=kid, 3=alg. Per-key-type parameters use negative integer keys (e.g. -1=crv, -2=x, -3=y for EC2). The format is compact, self-describing, and crypto-suite agnostic — exactly what WebAuthn needs to ship a public key inside the attestation envelope.
Spec
RFC 8152 §7 (COSE Key Objects).
IANA registry
COSE algorithm and curve identifiers are tracked in the IANA COSE Algorithms registry.
Use
WebAuthn credentialPublicKey · CTAP2 messages · CWT (CBOR Web Tokens).
Frequently asked questions
What is a COSE_Key?
A CBOR map describing a public key, defined in RFC 8152. WebAuthn puts the credential public key in this form inside attested credential data, so a relying party parses COSE rather than SPKI.
What do kty and alg mean?
kty is the key type — 2 for EC2, 1 for OKP, 3 for RSA. alg is the COSE algorithm identifier, and it is negative for the common signature algorithms: -7 for ES256, -8 for EdDSA, -257 for RS256.
Why are the labels negative numbers?
COSE reserves negative labels for key-type-specific parameters. For an EC2 key, -1 is the curve, -2 the x coordinate and -3 the y coordinate; the same numbers mean different things under a different kty.
How do I convert this to a normal public key?
Read kty and crv, then rebuild an SPKI structure from the coordinate byte strings. Most server libraries do this for you; the failure mode to watch for is dropping a leading zero from x or y.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.