Identity artefact analyser
Inspect tokens and federation assertions locally
Paste JWT/JWS, SAML 2.0, WS-Federation, OIDC discovery metadata, JWKS or SAML metadata. Analysis stays in this browser tab.
🛡️Local onlyNo token uploads or telemetry
Validation model: decoded does not mean verified; verified does not mean trusted. Signature, time, issuer, audience, protocol semantics and key provenance are reported independently.
Analysis
Identity artefact results
Summary
Protocol details
Validation dimensions
Findings
Identity data
Claims / attributes
Decoded material
Raw / decoded views
Portable evidence
Diagnostic report
Raw bearer tokens and assertions are excluded by design.
v0.4 · claims migration
Compare claims across identity providers
Compare JWT, SAML or WS-Fed claim sets. Common aliases are normalised so protocol migrations can be compared semantically.
Migration summary
Claims compatibility
Difference
Normalised claim comparison
Portable migration evidence
Claims migration report
Highlights renamed/mapped claims and high-impact identity/authorisation differences.
v0.6 · federation analysis
Inspect and compare federation configuration
Supports OIDC discovery documents, JWKS, SAML metadata and OpenID Federation entity statements. URLs are parsed but never contacted.
Configuration A
Summary & findings
Configuration B
Summary & findings
Configuration drift
Federation comparison
Migration analysis
Issuer & signing-key transition
Detects issuer/entity-identifier changes, JWKS key overlap/removal and SAML signing-certificate rotation.
Architecture & privacy
Security boundaries
Identity artefacts often contain personal information and live bearer credentials. The public application is deliberately static and local-first.
Runtime boundary
- No backend, analytics or telemetry.
connect-src 'none'; no fetch/XHR/WebSocket/EventSource path.- No token/claim persistence to localStorage, sessionStorage or IndexedDB.
- Raw tokens are excluded from diagnostic reports.
- jku, x5u, jwks_uri, federation endpoints and SAML URLs are displayed only.
XML signature verification
xmldsigjs 2.8.8is vendored locally underpublic/assets/js/external/.- Package/runtime versions are pinned in
package.json; the build records bundled versions in a SHA-384 vendor manifest. - The local script is loaded with an SRI
integrityattribute. - CI independently recalculates the bundle hash and compares it with both the manifest and HTML SRI value.
- Valid XMLDSig does not imply trusted signing certificate or valid SAML profile.
Roadmap foundation
Implemented surfaces
Alpha scope: these are implementation foundations, not claims of complete protocol conformance. See
ROADMAP.md and SECURITY.md for hardening work required before stable 1.0.