Credential ID Inspector
Inspect a WebAuthn credentialId. Reports length, Shannon entropy, common envelope shapes, and any AAGUID-shaped prefix vendors prepend. Diagnostic only — credentialIds are opaque to the RP.
How to use this tool
What it does
Decodes a WebAuthn credential ID and shows its length and encoding.
When to use it
Use it when matching a returned credential to a stored one, or checking an ID's size limits.
Worked example
Decode a credential ID from an assertion to compare it against your stored allow-list entry.
Input
Inspection
About credentialId
credentialId is opaque to the relying party. Some authenticators store the underlying credential locally and return a small ID (resident / discoverable creds); others wrap an encrypted blob in the ID itself (server-side resident — credential lives on the server, key wrap lives on the authenticator). Either is spec-compliant.
Spec
WebAuthn Level 2 §5.1.
Companion
Frequently asked questions
What is a credentialId?
The opaque handle a relying party stores to refer to a credential. Its only defined property is that the authenticator recognises it — length and internal structure are entirely implementation-specific.
Should a relying party parse a credentialId?
No. It is opaque by specification. This tool exists for diagnostics during integration work, not for logic you should ship.
Why do credentialIds vary so much in length?
Because two strategies exist. Some authenticators store the credential and return a short random handle; others wrap the encrypted private key into the credentialId itself, which makes it long but requires no on-device storage.
Why does my credentialId start with something that looks like an AAGUID?
Some authenticators derive the handle in a way that leaves recognisable structure at the front. It is a coincidence of implementation and must not be relied on.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.