WebAuthn AAGUID Lookup

Reading the example

The example is a real registration made with Windows Hello. Its attestationObject decodes to attestation format “none” and authenticator data whose flags say the user was present and verified, with attested credential data attached. Bytes 37 to 52 of that data are 6028b017-b1d4-4c02-b4b3-afcdafc96bb2, which is Windows Hello’s AAGUID, and the credential’s public key is an RSA key for RS256.

WebAuthn attestation decoder

Beyond the name, this works as a WebAuthn attestation decoder: it reads the CBOR attestationObject, the flags byte (UP, UV, BE, BS, AT, ED), the signature counter, the credential ID and the COSE public key type, and the origin from clientDataJSON. BE and BS together mean a synced passkey that is backed up; a hardware security key shows neither.

Extract the AAGUID in your own code

TypeScript (browser)

// credential = await navigator.credentials.create({ publicKey })
const authData = new Uint8Array(credential.response.getAuthenticatorData());
if (authData[32] & 0x40) { // AT flag: attested credential data present
  const hex = Array.from(authData.slice(37, 53), (b) => b.toString(16).padStart(2, '0')).join('');
  const aaguid = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
}

Python

import uuid

# auth_data: the authData bytes from the decoded attestationObject
if auth_data[32] & 0x40:
    aaguid = str(uuid.UUID(bytes=bytes(auth_data[37:53])))

Go

import "github.com/google/uuid"

// authData: the authData bytes from the decoded attestationObject
if authData[32]&0x40 != 0 {
	id, _ := uuid.FromBytes(authData[37:53])
	aaguid := id.String()
}

Passkey AAGUID list

The full passkey AAGUID list built into this page: 396 authenticators, 58 of them passkey providers from the community list and the rest FIDO2 security keys and platform authenticators named in the FIDO Metadata Service — the FIDO2 AAGUID lookup table for YubiKey, Titan, Feitian, Windows Hello and more.