privileged.id

Identity & privileged-access security

Who can do what, proven how, for how long.

A reference on least privilege, admin and service accounts, phishing-resistant MFA, passkeys, and OAuth 2.0, OpenID Connect and SAML, written from the standards themselves and checked against them.

Decode a JWT Step through an OAuth flow

  • 27 reference pages, each with its primary sources and a review date
  • 37/37 tool checks against RFC test vectors pass
  • 0 trackers, cookies or third-party requests

Tools that never phone home

Paste tokens and messages without worrying where they go: everything runs in this page. All tools →

Tool · JWT JWT decoder and inspector Paste a JWT to see its header and claims explained, with warnings for expiry, risky algorithms and missing audience. Optionally verify the signature locally with a public key. Tool · SAMLSAML decoderPaste a SAMLResponse, a SAMLRequest, a whole HTTP-Redirect URL or raw XML. The decoder undoes the binding's encoding, explains the fields a service provider must check, and flags structures that wrapping attacks use. Tool · OAuth 2.0OAuth flow visualiserStep through the authorization code flow with PKCE, the client credentials grant and the device authorization grant, one HTTP message at a time, with what each step protects against. Tool · NIST SP 800-63B-4Password policy checkerDescribe your password policy and see, rule by rule, where it meets or breaks NIST SP 800-63B-4 (July 2025), with the exact requirement strength and section for each. Tool · ChecklistLeast-privilege checklist builderPick the environments you run and get a checklist for reducing standing privilege there, with each item mapped to the NIST SP 800-53 control behind it. Tick items off and export it as Markdown.

Start here

Four pages that change how most teams handle identity.

Privileged access Least privilege Grant only the access a task needs, for people, admins and workloads alike. What SP 800-53 AC-6 and AC-5 actually ask for, and how to keep it true over time. Authentication Phishing-resistant MFA Authentication whose output only works for the genuine site, without relying on the user to spot the fake. How it works, what qualifies, and what it does not cover. OAuth 2.0 Authorization code flow with PKCE The one OAuth flow every user-facing client should use, request by request, with the RFC 7636 test vector and the rules from RFC 9700 and RFC 8252. OAuth 2.0 OAuth security mistakes (RFC 9700) A plain-English, section-by-section summary of the current OAuth security best practice, with the exact requirement strength of each rule.

Privileged access

The accounts that can change everything deserve the most care. These pages cover who should hold privilege, for how long, how it is granted and watched, and how machines get credentials without leaving secrets lying around.

Authentication

Proving who someone is, and how much that proof is worth. Written from NIST SP 800-63B-4, CISA guidance and the W3C WebAuthn specification.

Protocols

The protocols that carry identity between systems, explained from the specifications with real HTTP messages: what each step does, what each token means, and where implementations go wrong.

How this site is made

Primary sources only

Requirements come from NIST, IETF, OpenID Foundation, OASIS and W3C documents, with the exact strength (SHALL, SHOULD, MAY) the text uses. Every page lists its sources and the date it was last checked.

Tested tools

The JWT verifier, PKCE generator, SAML decoder and password checker are tested against the RFCs' own example tokens and keys on every build: 37 of 37 checks pass. See the results.

No vendor in the room

No sponsors, no affiliate links, no product recommendations. Where a choice depends on your environment, the page says what it depends on.