FIDO Metadata Explorer
Browse the curated AAGUID directory in metadata-style cards: vendor, model, transports (USB / NFC), form factor, and the credential class each provider documents. Searchable. It is a static, hand-curated list, not data from the FIDO Metadata Service; for production attestation policy, fetch and verify the FIDO MDS BLOB.
Credential class here reflects each provider’s documented behaviour for the model — it is a directory, not a measurement. Backup Eligible (BE) and Backup State (BS) live in authenticatorData and are only known from a real registration, so read them there rather than inferring them from an AAGUID or a vendor name. Platform authenticators are not automatically synced, and a synced passkey is not a hardware security key.
How to use this tool
What it does
Browses a curated directory of common authenticator models keyed by AAGUID: vendor, model, USB / NFC transports, form factor and documented credential class. It is not a live copy of the FIDO Metadata Service.
When to use it
Use it to put a name and form factor to an AAGUID while drafting an allow-list. Take certification status, key protection and status reports from the verified MDS BLOB, not from this page.
Worked example
Search an AAGUID or vendor to see the model, transports, form factor and credential class recorded for it.
Filter
Authenticators
This page versus the FIDO MDS
This page provides model orientation only: an AAGUID lookup with vendor, model, USB / NFC transports, form factor and the credential class each provider documents, from a static list of common models curated by AmbiSecure. It is not built from an MDS snapshot and is not updated in real time.
The FIDO Metadata Service provides the authoritative inputs: current metadata statements, attestation root certificates, and status reports including certification level and revocation. It publishes them as a signed BLOB at https://mds3.fidoalliance.org/, verified against the GlobalSign R46 root. The FIDO Alliance suggests downloading it about once a month and caching it. Enforce AAGUID policy at registration from that verified data, not from this page.
Companion
Next step
Production attestation policy belongs on the relying-party server, which fetches and verifies the MDS BLOB. See the FIDO validation server, or the AAGUID reference for the identifier itself.
Frequently asked questions
What is the FIDO Metadata Service?
The FIDO Alliance service that publishes a signed BLOB of vendor-submitted metadata statements (AAGUID, key protection, attestation roots, transports) and status reports such as certification level or revocation. It is the authoritative source for attestation policy.
Can I use this page as my metadata source in production?
No. This is a static, hand-curated list for orientation and is not derived from an MDS snapshot. A production relying party fetches the MDS BLOB, verifies its signature and certificate chain, and keeps a current copy. Do not build an enterprise allow-list from this page.
What can metadata tell me that an AAGUID alone cannot?
Whether the model is certified and to what level, how keys are protected, which transports it supports, and whether any status reports mark it as compromised — the last being the point of consulting metadata at all.
Why does an authenticator not appear here?
This is a small curated subset, so most authenticators are not in it and absence here means nothing. Check the FIDO MDS itself: absence from the real MDS is policy-relevant, because the model's claims cannot then be checked against FIDO data.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.