Identity Protocol Debugger Now Supports SD-JWT VC Issuance and Presentation Flows

Another day, another identity specification to debug.

I’m pleased to announce that Identity Protocol Debugger now supports the complete SD-JWT VC Issuance and SD-JWT VC Presentation workflows.

That effectively gives the debugger support for the following:

RFC9901 and Supporting Specs

If you’ve ever spent an afternoon wondering why your selectively disclosed claim refuses to verify, or why your Key Binding JWT doesn’t quite bind, this update is for you.

Why SD-JWT VC?

Traditional JWT-based credentials have a rather unfortunate personality trait: they love to overshare.

Need to prove you’re over 18?

Here’s your full date of birth.

Need to prove you’re an employee?

Here’s your employee ID, department, office location, manager, favorite coffee order…

Okay, maybe not the coffee order.

The point is that conventional credentials generally reveal far more information than necessary.

SD-JWT Verifiable Credentials solve this by allowing a holder to disclose only the claims required for a particular transaction. The issuer cryptographically commits to every claim, while the holder chooses which ones to reveal during presentation.

It’s one of the most practical examples of data minimization making its way into modern identity protocols.

Supported Workflows

The debugger now supports both halves of the protocol.

SD-JWT VC Issuance

Generate and inspect issued credentials, including:

• SD-JWT payloads
• Disclosure objects
• Hash commitments
• Issuer signatures
• Key Binding JWTs (where applicable)

Rather than treating the credential as an opaque blob of Base64, you can inspect each component individually and understand exactly what was signed and why.

Because if you’re debugging cryptography, “it looks fine to me” is rarely an effective troubleshooting strategy.

SD-JWT VC Presentation

The presentation workflow allows you to:

• Load an SD-JWT VC
• Select disclosures
• Generate presentations
• Inspect disclosed and undisclosed claims
• Validate signatures
• Verify disclosure hashes
• Examine Key Binding JWTs

This makes it much easier to understand how selective disclosure actually works in practice.

Instead of mentally reconstructing the protocol from the specification, you can watch each artifact evolve throughout the presentation process.

Why This Matters

SD-JWT VC is one of the more sophisticated credential formats currently emerging within the identity ecosystem.

Unlike traditional JWTs, a credential is no longer just Header + Payload + Signature.

Instead, an SD-JWT VC consists of multiple related artifacts:

• The signed JWT
• One or more disclosure objects
• Optional decoy disclosures
• Optional Key Binding JWTs
• A presentation assembled dynamically by the holder

That’s a lot of moving parts.

When something goes wrong, figuring out which moving part is responsible can be… educational.

The debugger is designed to make those moving parts visible instead of hiding them behind a single opaque string.

Built for Learning (And Troubleshooting)

As with the rest of Identity Protocol Debugger, the goal isn’t simply to tell you whether something is valid.

The goal is to help you understand why.

Every protocol eventually reaches the point where packet captures, JWT decoders, and copy-and-paste debugging stop being enough.

That’s where specialized tooling becomes invaluable.

Whether you’re implementing an issuer, building a wallet, integrating a verifier, or simply trying to understand the protocol, being able to inspect every artifact individually makes the specifications considerably less intimidating.

More to Come

The Verifiable Credential ecosystem continues to evolve rapidly, and so will Identity Protocol Debugger.

Expect additional support for emerging specifications, richer visualization of credential structures, expanded validation capabilities, and more protocol debugging features in future releases.

As always, feedback, feature requests, and bug reports are welcome.

Happy debugging!

Check out IDPTools.com