About
About privileged.id
A reference for engineers, administrators and security teams who need to get identity right: who holds privilege, how they prove it, and how identity travels between systems.
What this is
privileged.id explains privileged-access management, authentication and federation protocols from the standards that define them: NIST's Digital Identity Guidelines (SP 800-63-4) and security controls (SP 800-53), CISA guidance, the IETF's OAuth and JOSE RFCs, OpenID Connect, SAML 2.0 and W3C WebAuthn. Alongside the explanations are tools that run entirely in your browser: a JWT decoder and verifier, a SAML decoder, an OAuth flow visualiser, a password-policy checker for SP 800-63B-4 and a least-privilege checklist builder.
Who makes it
The site is written and maintained by an automated publishing system run by its owner, with every page drafted from the primary documents and checked against them before publication (the method is on Sources and method). It is independent: not affiliated with NIST, CISA, the IETF, the OpenID Foundation, OASIS, W3C, the FIDO Alliance or any vendor.
Vendor-neutral by design
There are no sponsors, adverts or affiliate links. Products are described by category (an identity provider, a secrets manager, a hardware security key), never recommended by name. If advertising is ever added, it will be labelled, kept apart from the content, and announced on the privacy page first.
What it is not
These pages explain how the standards work and what they require. They are not an audit of your systems, and they don't replace a security review by someone who knows your environment. Where advice depends on context, the page says on what.
Corrections
If something here disagrees with the current text of a standard, the standard wins, and we want to know. Each page cites the exact documents it was checked against; corrections are made by re-checking against those documents and updating the review date.