Qredential playground, break it yourself

qredential
Scan a credential and get an answer with no network connection. Everything on this page runs in your browser.
ES256 · SD-JWT
Generating an issuer key pair and signing a demo credential…

The credential

A fictional driving licence from id.arcadia.example. Two separate decisions shape what a verifier ends up seeing: the issuer decides which claims may be withheld, and then the holder decides which of those to actually show. Change either column and the QR code rebuilds.

Claim Value Issuer allows
withholding		 Holder
reveals

What actually travels


      


      

        
Presented code

        

          

          
Error correction M

        

        

        

      

    


    

      
Verifier

      

        The result below is produced by verify() running against a pinned trust list and a cached status list. No request leaves the page.
      

      

        

          
Ready

          

          

        

        

          
Honest presentation

          

          

        

      

    


    

      
Try to break it

      

        Each button takes the credential above and does something an attacker would actually do, in plain string operations. The expected rejection code is printed on the button, so you can check the library against its own claims.
      

      

    


    

      
Verify any payload

      

        Paste a QC1: envelope, or the raw SD-JWT form. Only the demo issuer is on this page's trust list, so a credential from anywhere else is rejected as an unknown issuer, which is the correct answer.