01 / guides
Topic guides
Authentication, authorization, federation, provisioning and audit, plus OAuth security, mobile and social login. Each guide answers the practical question first.
Browse the guidesOAuth · OpenID Connect · SAML · SCIM · JWT
Identity & API Security, Explained
An independent reference library for developers and architects who build sign-in, federation and API access. Plain explanations of the standards, current security advice, and free tools that run entirely in your browser.
- Standards-first, vendor-neutral
- Tools never upload your tokens
- Free, no sign-up
What you'll find here
02 / tools
Developer tools
Decode JWTs and SAML messages, generate PKCE pairs, build authorize URLs and write security headers. All client-side.
See all tools03 / platforms
Platform overviews
What API gateways, federation servers, policy engines and identity governance systems do, and how to choose, without vendor spin.
Compare categoriesThe standards, in one line each
GlossaryRFC 6749
OAuth 2.0
Delegated authorization. A client gets a scoped access token to call an API on a user's behalf, without ever seeing the password.
OAuth security guideOIDC Core 1.0
OpenID Connect
Identity on top of OAuth 2.0. The ID token is a signed JWT that says who signed in, when, and how.
From OpenID to OIDCOASIS 2005
SAML 2.0
XML assertions for browser single sign-on. Still the workhorse of enterprise SSO into SaaS.
Federation guideRFC 7643/7644
SCIM 2.0
A REST schema and protocol for creating, updating and removing user accounts across systems.
Provisioning guideRFC 7519
JWT
A compact, URL-safe token format: a header, a set of claims and a signature, joined by dots.
Decode a JWTXACML 3.0
XACML / ABAC
Policy-based authorization. Decisions come from attributes of the user, resource, action and context.
Authorization guideFree tools
All toolsJWT Decoder & Inspector
Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
PKCE Generator
Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
SAML Response Decoder
Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
Authorization URL Builder
Build an OAuth 2.0 or OpenID Connect authorize URL parameter by parameter, with warnings for insecure combinations.
Security Header Builder
Generate HSTS, CSP, Referrer-Policy and nosniff headers for nginx, Apache, IIS, Jetty and static hosts.
Latest articles
All articles- Information security
POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1
How the 2014 POODLE attack broke SSLv3, why RFC 7568 and RFC 8996 later retired SSLv3, TLS 1.0 and 1.1, and which TLS settings to use for identity and API servers.
- Federation
AD FS Claim Rules for LDAP Attribute Stores, Line by Line
A line-by-line guide to AD FS claim rules that query LDAP attribute stores: conditions, issue versus add, store, types, query format, param and escaping rules.
- Federation
Using an LDAP Attribute Store in AD FS
How to add an LDAP attribute store to AD FS, connect it to AD LDS or another directory, and use it in claim rules for attributes AD does not hold.
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Federation
SP-Initiated SSO on .NET: From WIF to Modern Libraries
How service provider initiated sign-in works, why Windows Identity Foundation only covered WS-Federation, and the options for SAML 2.0 and OIDC on ASP.NET Core.
- Events & community
Planning API Security Training for a Distributed Team
A practical curriculum for teaching API security to developers spread across offices and countries: modules, hands-on labs, formats and how to measure if it worked.
Follow identity security on X (Twitter)
Spec editors, security researchers and identity engineers discuss drafts, incidents and fixes on X every day. These searches open the latest posts on x.com in your browser.
Share a JWT tip
Pick a tip or write your own. Counted the way X counts: links take 23 characters.
0 / 280Post on X
Twobo Technologies is not affiliated with X Corp. Links open x.com; nothing on this page connects to your account.
Questions
Is Twobo Technologies a consultancy or a vendor?
Neither. It is an independent educational site with guides and free developer tools on identity and API security. It sells nothing, resells nothing and has no vendor partnerships, so product pages describe categories and products neutrally.
Do the tools send my tokens anywhere?
No. The JWT decoder, PKCE generator, SAML decoder, URL builder and header builder run as JavaScript in your browser. Nothing you paste is uploaded, logged or stored on a server. You can load a tool page, go offline, and it keeps working.
Is it safe to paste a production token into a decoder?
Treat any live token as a credential. Our decoder runs locally, but the safer habit is to paste expired or test tokens, and to revoke a production token if it ever ends up somewhere it should not be, such as a chat or a ticket.
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 (RFC 6749) is an authorization framework: it lets a client get an access token to call an API. OpenID Connect is an identity layer on top of OAuth 2.0 that adds the ID token, a signed JWT that tells the client who the user is and how they signed in.
Is OAuth 2.1 a finished standard?
Not yet. As of November 2026, OAuth 2.1 is still an IETF Internet-Draft (draft-ietf-oauth-v2-1). Its main rules, such as PKCE for every authorization code flow and no implicit or password grants, already appear in RFC 9700, the OAuth 2.0 Security Best Current Practice published in January 2025.
Should I still use SAML in 2026?
Yes, where it already works. SAML 2.0 remains the most common protocol for enterprise single sign-on into SaaS applications. For new consumer, mobile and API work, OpenID Connect and OAuth 2.0 are usually the better fit.