OAuth 2.0, OIDC & PKCE Debugger
Security Network on demand
Passkey & WebAuthn Tester
Local WebAuthn · secure originRun real passkey ceremonies, decode credential evidence, verify assertions, and inspect browser support.
WebAuthn needs a supported browser and secure context
The browser binds the ceremony to —. Native credential UI and authenticator policy still apply.
Challenges and public credential material stay only in this tab. No server account is created.
Ready for a passkey ceremony
Create a test passkey for this site, then authenticate it to verify the signed assertion in memory.
How to use it
- 01
Run a ceremony
Create a passkey for the current secure origin and authenticate it through the browser's native credential UI.
- 02
Inspect the evidence
Decode clientDataJSON, authenticator data, attestation CBOR, flags, counters, extensions, and transports locally.
- 03
Verify assumptions
Check challenge, origin, RP ID hash, presence, verification and signature results, then export a redacted report.
Frequently asked questions
Can I test a different RP ID?
No. Browsers bind WebAuthn ceremonies to the current secure origin and eligible RP ID suffixes. This tool intentionally uses the current hostname.
Is the passkey saved by Nobuf?
The authenticator may persist the credential, but Nobuf keeps only the public credential material needed for this tab's test in memory and does not upload it.
Does decoding prove a response is authentic?
No. Decoding only exposes evidence. A relying party must verify challenge, origin, RP ID hash, flags, signature, credential ownership, counters and policy on a trusted server.
Why can capability results differ between browsers?
WebAuthn Level 3 capability APIs and conditional mediation are progressively implemented, and browsers may deliberately expose limited information for privacy.
Related tools
Keep working with other focused browser utilities.