WebAuthn Credential Generator

The WebAuthn Credential Generator produces random byte strings shaped like the credential IDs and public-key material you see during a WebAuthn (passkey / FIDO2) ceremony, and renders each one in the four encodings those values normally travel as: Base64url, standard Base64, hex, and a decimal byte array. It is a fast way to create realistic-looking test fixtures, populate a credential store in an integration test, or illustrate the exact shape of a credential ID in documentation.

This generates synthetic test data, not real credentials

Despite the name, this tool does not call navigator.credentials.create(), talk to an authenticator, or perform any attestation or assertion. It simply draws random bytes from a cryptographically secure random number generator (CSPRNG) and re-encodes them. The output looks like a credential ID — same length, same alphabet — but it has no cryptographic relationship to any real key pair, device, or account. Treat every value as throwaway test data. Never register one as a real passkey; a genuine credential ID is minted by an authenticator during a real registration ceremony, not by a formatter.

How to use it

Generate mode

1. Choose a byte length. WebAuthn credential IDs are typically 16–64 bytes; 16, 32, 64, and 128 are offered.
2. Set how many IDs to produce (1–10).
3. Click Generate. Each output box lists the results one per line, so a batch stays aligned across all four encodings. Click again for a fresh set.

Decode mode

1. Switch the mode to Decode a credential ID.
2. Paste a Base64url credential ID (standard Base64 is also accepted).
3. It is decoded to bytes and shown in all four representations — handy for inspecting a value captured from a real ceremony or a log.

The four encodings

• Base64url — the canonical WebAuthn encoding: URL- and cookie-safe (- and _ instead of + and /) with padding stripped. This is what a PublicKeyCredential's id string looks like.
• Base64 — standard Base64 with +, /, and = padding, for systems that expect the classic alphabet.
• Hex — lowercase, two characters per byte; convenient for logs and database columns.
• Raw byte array — a decimal [1, 2, 3, ...] literal you can paste straight into JavaScript or a test as a Uint8Array source.

Are the values cryptographically random?

Yes. Bytes come from a CSPRNG (crypto.getRandomValues in the browser), the same class of generator used for real keys — so the length and distribution match production credential IDs, which is what makes the fixtures realistic.

Privacy

Everything runs entirely in your browser. Generated bytes are never sent to a server, and anything you paste into decode mode stays on your machine.