privileged.id

Method

Sources and method

What every page is written from, how claims are checked, and the published test vectors the tools are tested against on every build.

Updated

How pages are written

Each page starts from the primary document: the NIST Special Publication, the IETF RFC, the OpenID Foundation, OASIS or W3C specification. Requirements are paraphrased in our own words and checked line by line against that text; brief quotations are marked as quotations and linked to the section they come from. Practices that are widespread but not required by any standard are labelled as common practice.

Every page shows the date it was last checked against its sources. Standards move: NIST SP 800-63B-4 (July 2025) replaced the 2017 edition, RFC 9700 (January 2025) updated OAuth's security advice, and OAuth 2.1 is still an Internet-Draft. When a source is revised, the pages that cite it are re-checked and their review date changes.

The site is vendor-neutral. It names protocols, standards bodies and government guidance, and describes product categories generically. It carries no sponsorship, advertising or affiliate links.

Requirement words

NIST and IETF documents use specific words for requirements, and the difference matters. This site keeps them:

WordMeaningDefined in
SHALL / MUSTA requirement. SHALL NOT and MUST NOT are prohibitions.NIST SP 800-63-4 conventions; RFC 2119 and RFC 8174
SHOULDA recommendation: there may be valid reasons to do otherwise, but the implications must be understood.Same
MAYPermitted, optional.Same

Tool validation

The tools' code is the same file in your browser and in the build. Before the site is published, gen/test_tools.js runs that code under Node.js (WebCrypto) against the published examples below; if any check fails, the build stops and the previous version stays online. Last run 2026-11-02 on Node v20.19.2: 37 of 37 passed.

AreaCheckResult
JWS signatureRFC 7515 Appendix A.1.: HS256 verifiesPass
JWS signatureRFC 7515 Appendix A.1.: altered payload is rejectedPass
JWS signatureRFC 7515 Appendix A.2.: RS256 verifiesPass
JWS signatureRFC 7515 Appendix A.2.: altered payload is rejectedPass
JWS signatureRFC 7515 Appendix A.2.: key found in a JWK SetPass
JWS signatureRFC 7515 Appendix A.3.: ES256 verifiesPass
JWS signatureRFC 7515 Appendix A.3.: altered payload is rejectedPass
JWS signatureRFC 7515 Appendix A.3.: key found in a JWK SetPass
JWS signatureRFC 7515 Appendix A.4.: ES512 verifiesPass
JWS signatureRFC 7515 Appendix A.4.: altered payload is rejectedPass
JWS signatureRFC 7515 Appendix A.4.: key found in a JWK SetPass
JWS signatureRFC 8037 Appendix A.4: EdDSA verifiesPass
JWS signatureRFC 8037 Appendix A.4: altered payload is rejectedPass
JWS signatureRFC 8037 Appendix A.4: key found in a JWK SetPass
JWT decodingRFC 7519 §3.1 example: iss=joe, exp=1300819380, is_root=truePass
JWT analysisExpired example token is flagged as expiredPass
JWT analysisalg none is flaggedPass
JWT analysiscase variant of none is flaggedPass
JWT analysisduplicate claim names are flaggedPass
JWT analysisDER-encoded ES256 signature is flaggedPass
JWT analysisRSA key offered for an HS256 token is refused (algorithm confusion)Pass
JWT analysiskey marked for a different alg is refusedPass
JWT decodingJWE (5 parts) is recognised, payload not decodedPass
JWT decodinginvalid base64url is reportedPass
PKCERFC 7636 Appendix B: S256(verifier) = published code_challengePass
PKCEgenerated verifier is 43 unreserved charactersPass
PKCEverifier shorter than 43 characters is rejectedPass
Password policylegacy preset fails exactly the expected SHALL/SHOULD rulesPass
Password policyconformant preset: no failures, nothing unansweredPass
Password policyevery rule in pwrules.json has logicPass
Password policy8 characters passes only when used with MFAPass
Password policy101 failed attempts exceeds the limit; 100 is allowedPass
Password policylength counts code points after NFC (e+combining acute → é; emoji = 1)Pass
SAML decodingHTTP-Redirect URL: URL-decode, base64, inflate → original XMLPass
SAML decodingHTTP-POST value: base64 → original XMLPass
SAML decodingform body SAMLResponse=… is unwrappedPass
SAML decodinggarbage input gives an error, not a crashPass

Example tokens and keys are extracted programmatically from the RFC text (RFC 7515 Appendix A.1–A.4, RFC 8037 Appendix A.4, RFC 7636 Appendix B) so a copying mistake cannot make a check pass. The SAML decoder's XML analysis needs a browser DOM and is checked in headless Chrome separately; XML signatures are listed, never claimed as verified.

Standards watch

Every week the site checks whether the documents it depends on have moved: a new revision of an Internet-Draft, a draft published as an RFC, a NIST publication superseded or withdrawn, a W3C specification changing maturity. A change puts the pages that cite the document back in the review queue.

DocumentStatusChecked
OAuth 2.0 for Browser-Based Applications
draft-ietf-oauth-browser-based-apps		Internet-Draft, revision -27 (2026-08-21)
The OAuth 2.1 Authorization Framework
draft-ietf-oauth-v2-1		Internet-Draft, revision -17 (2026-10-31) changed since review
SP 800-207Final, current
SP 800-53 Rev. 5Final, current
SP 800-63-4Final, current
SP 800-63B-4Final, current
SP 800-63C-4Final, current
WebAuthn Level 3W3C Recommendation

Licences

  • NIST and CISA publications: works of the U.S. government, not subject to copyright in the United States.
  • IETF RFCs: brief quotations with attribution, as the IETF Trust Legal Provisions allow.
  • OpenID Foundation, OASIS (SAML) and W3C (WebAuthn) specifications: cited and linked, with brief attributed quotations only.
  • FIDO Alliance, OWASP and other sites: cited for facts and linked; not reproduced.
  • Diagrams and illustrations: original to this site. Example tokens are the RFCs' own published examples; example hosts use reserved example.com-style names.

Every source cited

CERT Coordination Center

CISA

FIDO Alliance

IETF

NIST

OASIS

Office of Management and Budget

OpenID Foundation

USENIX

Unicode Consortium

W3C