The fido2viewer – a free FIDO2 debugging utility

Share this post:

Those of you who have been reading my recent series of blog posts will realize that I’ve been spending a great deal of time working on FIDO2 and WebAuthn related technologies. As part of this effort which has been in progress on and off for more than 12 months now, I put together a debugging utility that unpacks the common WebAuthn data structures that are passed between the browser and a WebAuthn relying party – such as ISAM which I’ve blogged about in my last few articles.

As a give-back to the general FIDO2 and WebAuthn development community I have released this debugging utility as open source – available on here:

The readme contained in the repository goes over all the basic usage of the tool. The tool runs entirely in client-side javascript, so no, I won’t be capturing any of your message data! It contains a couple of embedded test payloads that I’ve captured from interactions with IBM’s access management demonstration site (, however I know that these same payload formats are in common use with other WebAuthn relying parties as well.

So, who would use this tool, and why?

The primary target audience is other developers and educators working on FIDO-enabled systems (both IBM’ers and in general), our support team, and interested customers and business partners that really want to understand a little more about the detailed contents of message payloads that are generated (via the browser) on FIDO authenticators and are then sent to relying parties for either registration (attestation) or login (assertion) processing and validation.

When used in conjunction with the WebAuthn specification, and other Introduction to Web Authentication sites and articles, I hope the fido2viewer debugging utility will allow interested persons to quickly and easily understand what the underlying data elements of FIDO messages actually look like, and aid in debugging issues with FIDO-enabled systems. It has certainly been of help to me as we at IBM have been building out our own relying party systems!

More FIDO2 stories

IBM Security Verify Access: Remember Session – an advanced use case

IBM Security Verify Access version is now out the door. Among several new features is the Remember Session capability in the Web Reverse Proxy (WRP). This feature delivers to the browser either via persistent cookie or a HTTP response header an encrypted token which represents the username and (a configurable list of) attributes of […]

Continue reading

RIP epac.jsp (2007-2020)

It has been some time since I last wrote about new capabilities in our on-premises access management offering (formerly IBM Security Access Manager, now IBM Security Verify Access). In this article I’m going to share some history, and discuss one of my favourite recently added capabilities – something I personally asked the development team to […]

Continue reading

Protecting entire ISAM WebSEAL site with multi-factor authentication using stepup login

Today I’m going a bit old-school with information on a basic ISAM scenario that has been available for years. This has come up in field questions several times recently, I think mostly with people who are relatively new to ISAM but understand the need for multi-factor security as a standard part of the authentication workflow. […]

Continue reading