Free · no installation · fictional identities

The test bench for your
authentication.

Are you integrating a SAML or OpenID Connect sign-in? ID-Kit plays the role you are missing (the identity provider or the application), shows you every exchange, and when it fails it tells you why and how to fix it.

Test SAMLTest OpenID ConnectCheck a response without an account

Two protocols, two roles

SAML 2.0

Enterprise single sign-on: Entra ID, Okta, Keycloak, ADFS… ID-Kit plays the identity provider (IdP) to test your application, or the application (SP) to test your IdP.

  • Signatures, encryption, lifetimes, attributes, single logout
  • Simulated errors and attacks to check that your application rejects them
  • A check-by-check report
Explore SAMLUnderstand SAML

OpenID Connect and OAuth 2.0

The standard for web apps, mobile apps and APIs. ID-Kit plays the provider (OP) or the client (RP) and runs all the flows: code + PKCE, hybrid, device, CIBA, token exchange…

  • Advanced security features: PAR, JAR, JARM, DPoP, private_key_jwt
  • A "which flow to choose?" guide and sequence diagrams
  • Every token decoded and verified, every error explained
Explore OpenID ConnectUnderstand OIDC

How it works

1Choose your role

You are developing an application, or configuring an identity provider: ID-Kit plays the other side.

2Plug in

ID-Kit gives you addresses, metadata and test users. Copy them into your product.

3Run and understand

You see every request, every token, every check. A failure comes with its cause and its fix.

What you will find there

Tools without an account

JWT and SAML decoder, signature verifier, certificate reader, encoder, metadata diagnostics.

 Illustrated explanations

Sequence diagrams, protocol evolution timelines, advanced features explained simply.

 A space of your own

Your configurations, test history, certificate monitoring, sharing with a team.

Frequently asked questions

Is ID-Kit free?

Yes. ID-Kit is free, provided as is and without support. It is meant for testing SAML and OpenID Connect with fictitious identities.

What can be tested with ID-Kit?

On the SAML side, ID-Kit plays the identity provider (IdP) or the application (SP) with signatures, encryption, errors and simulated attacks. On the OpenID Connect and OAuth 2.0 side, it plays the provider (OP) or the client (RP) and runs the flows: code with PKCE, hybrid, device, CIBA, token exchange, with PAR, JAR, JARM and DPoP.

Do I need to create an account?

No for the tools: JWT and SAML decoders, certificate chain checker, metadata analysis, test resource server and request bin. An account is only useful to keep your test providers, their history and certificate monitoring.

Can I use real data?

No. ID-Kit only accepts fictitious identities: never enter a real password or real personal data.

How long is my data kept?

Test histories are deleted automatically after 90 days. The private keys of your test providers are encrypted, and deleting the account erases everything.

Good to know

ID-Kit is free, provided as is, without support. It is meant for testing with fictitious identities: never enter real passwords or real data. The limits are public.