About Twobo Technologies
An independent reference library on identity and API security, written for the developers and architects who build sign-in, federation and API access.
Twobo Technologies explains the standards and practices behind modern identity: OAuth 2.0 and the OAuth 2.1 draft, OpenID Connect, SAML 2.0, SCIM, XACML and attribute-based access control, JWT, PKCE, federation, single sign-on, API gateways and transport security. It pairs that writing with small developer tools that run in your browser.
The name is a nod to the number two: two factors, two parties in a federation, two sides of every trust boundary. It is simply the name of the site.
Who is it for?
Developers adding sign-in to an app, architects connecting an identity provider to hundreds of applications, security engineers reviewing an OAuth flow, and anyone who has stared at a SAMLResponse and wondered what it says.
How is the content written?
- Standards first. Every guide cites primary sources: RFCs, OASIS and OpenID Foundation specifications, NIST publications and vendor documentation.
- Current. Articles show when they were last updated. Facts that change, such as draft status or product names, are written with dates.
- Vendor-neutral. Product pages describe categories and products from public information. The site is not affiliated with, sponsored by or a reseller for any vendor, and it has no affiliate links.
- Practical. Each article answers its question in the first lines, then explains.
Many pages live at addresses that existed on this domain years ago. They have been rewritten from scratch, so links that people shared still lead somewhere useful.
How do the tools handle data?
The JWT Decoder, PKCE Generator, SAML Decoder, Authorization URL Builder and Security Header Builder run entirely in your browser. Nothing you paste is sent to a server. The site uses no cookies, no analytics and no third-party scripts. See the privacy page.
Independence note
Twobo Technologies was relaunched in 2026 as an independent educational site. This site is not connected to any person or business previously associated with this domain. It does not offer consulting, products or partnerships. Not affiliated with X Corp.
Contact
Corrections, questions and suggestions: contact@twobotechnologies.com. See the contact page for what to include.
Free tools
JWT Decoder & Inspector
Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
PKCE Generator
Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
SAML Response Decoder
Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
Authorization URL Builder
Build an OAuth 2.0 or OpenID Connect authorize URL parameter by parameter, with warnings for insecure combinations.
Security Header Builder
Generate HSTS, CSP, Referrer-Policy and nosniff headers for nginx, Apache, IIS, Jetty and static hosts.