Identity tools

Small tools for the everyday work of identity: reading tokens, building requests, checking metadata, certificates, provisioning messages and policies.

Each tool explains what it checks and why it matters, using the same terms as the Learn lessons. They work with any provider, not only Beyond the Login tenants.

Tokens

JWT decoder

Decode a JSON Web Token, format its header and claims, check its times and verify its signature with a key you paste.

SAML decoder

Decode a SAML request or response from XML, the POST binding or the redirect binding, check its conditions and format the XML.

OAuth and OpenID Connect

PKCE and state generator

Create a code verifier and challenge, state and nonce values, or check a verifier against a challenge.

Authorization request builder

Build an authorization request URL parameter by parameter, or paste one to read it back, with checks from the security best practice.

Discovery and JWKS checker

Read a provider's discovery document and published keys, and check them against the specifications.

Certificates

Certificate chain inspector

Read a PEM certificate chain: names, keys, extensions, fingerprints, and whether each certificate was issued by the next.

Provisioning

SCIM payload validator

Check a SCIM user, group, PATCH, bulk or list message against the core schema and protocol.

Authorization

Policy playground

Write rules in the illustrative format from the Authorization lessons and watch a decision point evaluate them, rule by rule.

What stays in your browser

The tools run as scripts in this page. Tokens, keys, certificates and messages you paste are decoded and checked here, and are not sent to Beyond the Login or anyone else. The discovery checker is the one tool that makes requests: when you give it an address, your browser fetches that discovery document and its keys directly from the provider.

Even so, treat real credentials with care. A token that is still valid works for whoever holds it, so prefer expired or test tokens, and never paste a private key into any website.

Create a tenant