WebAuthn Inspector

Inspect real WebAuthn/passkey ceremonies in DevTools: log create()/get(), decode options and responses, and flag common mistakes.

WebAuthn Inspector adds a WebAuthn panel to Chrome DevTools for debugging real passkey registration and sign-in ceremonies. Chrome’s built-in WebAuthn tab manages virtual authenticators. WebAuthn Inspector complements it by showing what actually happens when a page calls navigator.credentials.create() or navigator.credentials.get(). For each WebAuthn ceremony, it: • Shows pending, resolved, and rejected calls with timing. • Decodes clientDataJSON, attestationObject, authenticatorData, CBOR, AAGUID, credential public keys, flags, and signature counters. • Compares requested and returned extensions, making missing PRF, credProps, or largeBlob results easy to spot. • Flags common problems such as RP ID and origin mismatches, short challenges, short timeouts, missing user verification, and unsupported algorithms. • Reports browser capabilities, including platform authenticators and conditional mediation. • Copies a redacted ceremony as JSON for bug reports. Privacy Everything runs locally inside DevTools. WebAuthn Inspector has no host permissions, makes no network requests, and includes no analytics or telemetry. Ceremonies are observed only while the WebAuthn panel is open. Credential identifiers, user handles, and cryptographic extension outputs are redacted before copied data leaves the panel. WebAuthn Inspector is free and open source under the MIT License: https://github.com/ddyy/webauthn-inspector