Identity & passkeys
Register and sign in with a real passkey and name the authenticator behind it from the FIDO Metadata Service, validate OpenID Connect ID tokens and SAML responses, inspect the credentials of the EU Digital Identity Wallet (SD-JWT VC and mdoc), DPoP proofs, COSE and CWT, and HTTP requests signed by bots and AI agents. Tokens and keys are checked in your browser; the authenticator lookup asks our server for public metadata only.
12 tools
WebAuthn / Passkey Inspector
Decode passkey registration & login
Decode what the browser returns from navigator.credentials.create() and .get(): clientDataJSON, attestation object, authenticator data flags bit by bit, AAGUID, credential ID and the COSE public key — then verify the login signature locally.
Open toolPasskey Sandbox
Try passkey sign-up and sign-in
Register a real passkey and authenticate with it against a relying party that runs in this page: the WebAuthn options, each verification step of §7.1 and §7.2, the flags, the attestation and the credential record.
Open toolOIDC ID Token Validator
Validate OpenID Connect ID tokens
Paste an ID token and your client settings: every check of OpenID Connect Core §3.1.3.7, the signature against the provider's keys, at_hash and c_hash, and an audit of the discovery document.
Open toolSD-JWT Inspector
Decode and verify SD-JWT VC
Paste an SD-JWT or an SD-JWT+KB presentation: every disclosure with its digest and place in the payload, the issuer signature, the key-binding JWT and the status in a Token Status List.
Open toolmdoc / mDL Inspector
Verify mobile driving licences
Paste an ISO 18013-5 DeviceResponse or an OpenID4VP vp_token: every disclosed element checked against the Mobile Security Object, the issuer signature and certificate chain, validity and device authentication.
Open toolHTTP Message Signatures
Verify RFC 9421 signatures
Paste a signed HTTP request or response and its keys: the exact signature base of every signature, the verification, Content-Digest, and what each signature does not protect.
Open toolWeb Bot Auth Checker
Verify signed bot and agent requests
Paste a request signed by a crawler or an AI agent: the web-bot-auth signature profile, the Signature-Agent member, the key directory at /.well-known and the signature with the key it publishes.
Open toolCOSE & CWT Decoder
Decode and verify COSE and CWT
Paste COSE_Sign1, COSE_Sign, COSE_Mac0 or a CBOR Web Token in hex or base64: named headers and claims, CBOR diagnostic notation, and the signature or MAC checked with your key.
Open toolDPoP Proof Inspector
Check RFC 9449 DPoP proofs
Paste a DPoP header and the request it came with: the twelve server checks of RFC 9449, the signature against the embedded key, ath and the jkt thumbprint.
Open toolSAML Inspector
Validate SAML signatures and assertions
Paste a SAML Response, request or metadata — XML, POST base64 or a Redirect URL: the assertions, conditions and attributes, every XML signature and the element it really protects, and signature-wrapping checks.
Open toolXAdES Inspector
Inspect XAdES e-signatures
Open a signed XML document — an EU trusted list, an e-invoice, a signed contract: every XML-DSig reference verified, the XAdES baseline level, signing time, the signing-certificate reference and the qualified status of the signer.
Open toolAAGUID Lookup
Identify a passkey or security key
Enter the AAGUID from a WebAuthn registration, a UAF AAID or a model name, and get the authenticator’s entry in the FIDO Metadata Service: its name and icon, certification level, security status reports and attestation roots.
Open tool