FIDO Metadata Explorer
Browse the curated AAGUID directory in metadata-style cards: vendor, model, transports (USB / NFC), form factor, and the credential class each provider documents. Searchable. For production attestation policy, fetch and verify the FIDO MDS BLOB.
Credential class here reflects each provider’s documented behaviour for the model — it is a directory, not a measurement. Backup Eligible (BE) and Backup State (BS) live in authenticatorData and are only known from a real registration, so read them there rather than inferring them from an AAGUID or a vendor name. Platform authenticators are not automatically synced, and a synced passkey is not a hardware security key.
How to use this tool
What it does
Explores FIDO Alliance Metadata Service (MDS) entries — authenticator metadata keyed by AAGUID.
When to use it
Use it to check an authenticator's certification status and supported algorithms before allow-listing it.
Worked example
Search an AAGUID to read its MDS entry, including certification level and key protection.
Filter
Authenticators
About FIDO MDS
The FIDO Metadata Service publishes a JWS-signed BLOB at https://mds.fidoalliance.org/ listing every certified authenticator. Production RPs should fetch and verify on a daily schedule, then enforce AAGUID policy at registration time.
Spec
FIDO Metadata Service v3.
Companion
Frequently asked questions
What is the FIDO Metadata Service?
A signed directory published by the FIDO Alliance describing certified authenticators — their AAGUIDs, certification status, key protection and transports. It is the authoritative source for attestation policy.
Can I use this page as my metadata source in production?
No. This is a browsable curated subset for orientation. A production relying party should fetch the MDS BLOB, verify its signature and certificate chain, and honour its expiry.
What can metadata tell me that an AAGUID alone cannot?
Whether the model is certified and to what level, how keys are protected, which transports it supports, and whether any status reports mark it as compromised — the last being the point of consulting metadata at all.
Why does an authenticator not appear here?
Either it is outside this curated subset, or it never registered metadata. Absence from the real MDS is itself policy-relevant: it means the model's claims cannot be independently verified.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.