The fido2viewer – a free FIDO2 debugging utility

Share this post:

Those of you who have been reading my recent series of blog posts will realize that I’ve been spending a great deal of time working on FIDO2 and WebAuthn related technologies. As part of this effort which has been in progress on and off for more than 12 months now, I put together a debugging utility that unpacks the common WebAuthn data structures that are passed between the browser and a WebAuthn relying party – such as ISAM which I’ve blogged about in my last few articles.

As a give-back to the general FIDO2 and WebAuthn development community I have released this debugging utility as open source – available on here:

The readme contained in the repository goes over all the basic usage of the tool. The tool runs entirely in client-side javascript, so no, I won’t be capturing any of your message data! It contains a couple of embedded test payloads that I’ve captured from interactions with IBM’s access management demonstration site (, however I know that these same payload formats are in common use with other WebAuthn relying parties as well.

So, who would use this tool, and why?

The primary target audience is other developers and educators working on FIDO-enabled systems (both IBM’ers and in general), our support team, and interested customers and business partners that really want to understand a little more about the detailed contents of message payloads that are generated (via the browser) on FIDO authenticators and are then sent to relying parties for either registration (attestation) or login (assertion) processing and validation.

When used in conjunction with the WebAuthn specification, and other Introduction to Web Authentication sites and articles, I hope the fido2viewer debugging utility will allow interested persons to quickly and easily understand what the underlying data elements of FIDO messages actually look like, and aid in debugging issues with FIDO-enabled systems. It has certainly been of help to me as we at IBM have been building out our own relying party systems!

More FIDO2 stories

Protecting entire ISAM WebSEAL site with multi-factor authentication using stepup login

Today I’m going a bit old-school with information on a basic ISAM scenario that has been available for years. This has come up in field questions several times recently, I think mostly with people who are relatively new to ISAM but understand the need for multi-factor security as a standard part of the authentication workflow. […]

Continue reading

Cross-origin session detection

Consider a federated single sign-on environment where an Identity Provider (IDP) for applications may in turn be acting as a gateway – and be configured as a Service Provider (SP) to many different other IDPs. The role of this IDP is to provide a common federated SSO service to applications. It may also need to […]

Continue reading

Account Recovery is just another Authentication Method

This article is an opinion piece geared toward (re)evaluating your thinking about end-user workflows for account recovery in traditional web authentication systems. Leaving aside superior PKI-based authentication schemes such as FIDO for a moment, let’s take a look at how account recovery scenarios on a traditional website might be made less attractive to attackers attempting […]

Continue reading