Identity, examined.
A vendor-neutral reference for the whole field: protocol deep dives, vendor analysis, global identity regulations, national eID schemes, and the best learning resources on the web. Sourced, dated, and free, for the people who build and study identity.
Built for people who build and study identity.
Independent and free. The protocols, the laws, the national eIDs, and the best learning material on the web, organized so you can actually learn from it.
Data-protection and identity regulations, each mapped to how it impacts authentication, consent, governance, verification, and data residency.
Explore →National digital identity schemes from Aadhaar to Login.gov, with the standards they use, how people authenticate, and honest privacy notes.
Explore →OAuth, OpenID Connect, SAML, WebAuthn, FAPI, SCIM, and verifiable credentials, explained for the engineers who implement them.
Explore →The best identity material on the internet: RFCs, NIST and OWASP guidance, academic research, industry reports, books, courses, talks, and podcasts.
Explore →Sourced identity-security statistics and a live standards tracker, every figure attributed, for analysts and researchers.
Explore →Working, code-forward guides: add login, validate a JWT, protect an API, set up SCIM provisioning, and add passkeys.
Explore →A world where every identity and security professional, in every country, has free and independent access to the knowledge to master IAM, and where the field's best practices are shaped openly by its practitioners, not its vendors.
We are a non-profit, vendor-neutral community. We curate trustworthy IAM knowledge, news, and jobs; connect practitioners across backgrounds and borders; and give the next generation of identity professionals a place to contribute, be credited, and grow, all in the open and free of commercial influence.
No sponsorship and no pay-for-placement. Opinions are clearly opinions; facts are sourced.
Every claim, score, and statistic carries a citation and a date you can check.
Free for everyone, written for a global audience, and welcoming AI and search engines that learn from it.
Every segment of identity, and the top tools in each.
The whole industry, mapped into six pillars, from workforce IAM and CIAM to PAM, machine identity, authorization, and what comes next.
Workforce Identity
Identity for employees, contractors, and internal systems.
- 20Workforce IAMTop: Microsoft Entra ID
- 18MFATop: Yubico
- soonPasswordless & Passkeys
- soonDirectory Services
- 22Password ManagementTop: 1Password
Customer Identity (CIAM)
Login, onboarding, and trust for the people who use your product.
- 30CIAM PlatformsTop: Auth0
- 44Identity Verification (IDV/KYC)Top: Persona
- soonConsent & Preference (CMP)
Privileged & Governance
Control, certify, and right-size who can do what.
Machine, Workload & Secrets
Identity for services, workloads, and the secrets they use.
Access, Authorization & Network
Decide and enforce access at the app and network edge.
- 11Authorization (FGA/ReBAC)Top: AuthZed
- 12Zero Trust Network AccessTop: Cloudflare Zero Trust
- soonIdentity Orchestration / Fabric
Emerging & Foundational
Where the industry is heading, and what it's built on.
The data behind the decisions.
Enterprise Readiness for B2B SaaS: SSO, SCIM, and Audit Logs
The identity features that turn a B2B SaaS product into one enterprises will buy: SAML and OIDC single sign-on, SCIM provisioning, audit logs, role-based access, and multi-tenant organization management, plus the order to build them.
- ArticleJul 16, 2026CIAM vs IAM: Key Differences and When You Need Each
CIAM and IAM both manage identity, but they solve opposite problems. This guide explains the differences in users, scale, priorities, and architecture, and how to tell which one your project actually needs.
- ArticleJul 16, 2026Identity for B2B SaaS: Multi-Tenancy, Enterprise SSO, and Admin Control
The identity model B2B SaaS actually needs: multi-tenant organizations, per-customer enterprise SSO and SCIM, delegated administration, and audit logs, plus why B2B identity is a different build from consumer login.
- ArticleJul 16, 2026Identity for Gaming: Scale, Social Login, and Child Safety
Identity in gaming has to handle massive spikes, near-zero login friction, cross-platform accounts, anti-cheat and account-takeover defense, and strict child-safety rules under COPPA and age-verification law.
- ArticleJul 16, 2026Identity for Government: National eIDs, Assurance Levels, and Access
How identity works in the public sector: national eID schemes and citizen login, identity assurance levels under NIST 800-63 and eIDAS, workforce credentials like PIV, and the accessibility and inclusion obligations unique to government.
- ArticleJul 16, 2026Identity for Insurance: Policyholders, Agents, and Fraud Defense
Identity in insurance spans policyholder logins, agent and broker access, and claims fraud defense, under privacy and sector rules. How to balance customer friction, distributor access control, and identity verification for KYC and claims.
- ArticleJul 16, 2026Identity for Retail and E-commerce: Requirements and Best Practices
How customer identity works in retail and e-commerce: guest versus account checkout, loyalty and personalization, account-takeover and fraud defense, and PCI DSS obligations, with the tradeoffs that decide conversion.
- ArticleJul 16, 2026Identity for Telecom: Subscribers, SIM Swap, and Scale
Telecom identity has to manage huge subscriber bases, secure SIM and eSIM provisioning against SIM-swap fraud, and support the account access that increasingly gates other services through phone-number verification.
- ArticleJul 16, 2026Passwordless CIAM: Passkeys and WebAuthn for Customer Login
How to bring passwordless authentication to customer login: where passkeys fit, how they differ from magic links and OTP, the account-recovery problem, and a rollout that raises security without hurting conversion.
Vendors we'd actually recommend.
Scored against a published capability matrix and re-evaluated on a published cadence.
Microsoft Entra ID
4.7/ 5Best for: Microsoft 365 and Azure-centric organizations
Read the profile →Okta
4.7/ 5Best for: Workforce SSO and lifecycle for mid-to-large enterprises
Read the profile →HashiCorp Vault
4.7/ 5Best for: Secrets management with dynamic, short-lived credentials for cloud infrastructure
Read the profile →Identity is a community of practice.
Behind every identity system are the people who designed it, shipped it, broke it, and rebuilt it better. We document their work, and connect you to where the conversations are happening.
New resources, analysis, and updates.
Resources, analysis, and identity news.
Weekly practitioner discussion.
When something material ships.
Channels by category.
r/StartWithIdentity
Occasional. Useful.
We send when something material ships: an annual report, a major vendor profile, a fresh interview. Maybe twice a month at peak. Often less.
SubscribeAuthored by people who've actually shipped identity at scale.
Every evaluation carries a date, an author, and a confidence level.
The capability matrix is open. You can see what we scored and how.
Anything that could shape a view is disclosed on the page.