RP ID / Origin Validator
Test whether a WebAuthn rpId is allowed for a given origin. Encodes the §5.1.3 registrable-domain-suffix rule, the HTTPS requirement, and PSL constraints — useful when planning multi-host SSO with shared passkeys.
How to use this tool
What it does
Checks whether a WebAuthn relying-party ID is valid for a given origin.
When to use it
Use it when a registration fails with an RP ID mismatch and you need to confirm the domain scoping rules.
Worked example
Test whether login.example.com is a valid RP ID for the origin https://www.example.com.
Input
Verdict
About RP ID
The RP ID is the scope of a WebAuthn credential. Browsers enforce that the rpId is a registrable domain suffix of the origin host, with HTTPS as a prerequisite (localhost is the only HTTP exception). Pick the broadest scope you want credentials to roam across — typically your apex domain.
Spec
WebAuthn Level 2 §5.1.3.
Companion
Frequently asked questions
What is an rpId?
The domain a WebAuthn credential is scoped to. It defaults to the origin's effective domain, and a credential is only usable on that domain or a subdomain of it.
What is the registrable-suffix rule?
An rpId must be the origin's domain or a registrable parent of it. login.example.com may set example.com, but never com, and never a domain it does not control.
Why does the public suffix list matter?
Because it stops a page setting an rpId that spans an entire registry. Without it, a site on a shared suffix could scope credentials across every unrelated site beneath it.
Does WebAuthn work over plain HTTP?
Only on localhost, which browsers treat as a secure context for development. Every other origin must be HTTPS.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.