Workspaces1/10
Manage projectsOpen tool tabs

Active workspace: Personal. Open tools and saved data belong to this workspace.

RFC Standards Reference

Local processing
Selected RFCs with explanations, maturity levels and replacement links
Standards, sources and review dates
  • OAuth security BCP · RFC 9700 · January 2025 · Reviewed

    Authorization Code + PKCE S256, exact redirect matching, no password grant. Metadata checks do not validate an authorization server. Review interval: 90 days.

  • JWT security BCP · RFC 8725 · February 2020 · Reviewed

    Decoding does not verify authenticity. Verification must constrain algorithms, keys, issuer, audience, token purpose and time claims. Review interval: 90 days.

  • HTTP Problem Details · RFC 9457 · July 2023 · Reviewed

    Obsoletes RFC 7807; application/problem+json reference. Review interval: 90 days.

  • TLS 1.3 · RFC 9846 · July 2026 · Reviewed

    RFC 9846 replaces RFC 8446. The reference separates publication maturity and replacement links from deployment advice; it does not test protocol conformance. Review interval: 30 days.

Runnable debugging guides
Showing 72 of 72 standards
Security - TLS
5
RFCTitleMaturity
Year
Related
RFC 9846
The Transport Layer Security (TLS) Protocol Version 1.3
TLS 1.3 specification replacing RFC 8446; also updates TLS 1.2 requirements.
Proposed Standard2026
RFC 5077
RFC 5246
RFC 6961
RFC 7627
RFC 8422
RFC 8446
RFC 8446
TLS 1.3
Earlier TLS 1.3 specification; replaced by RFC 9846.
Replaced by: RFC 9846
Proposed Standard2018
RFC 5246
RFC 5246
TLS 1.2
TLS 1.2 specification; follow its replacements and deployment guidance.
Replaced by: RFC 8446RFC 9846
Proposed Standard2008
RFC 8446
RFC 6066
TLS Extensions
TLS extensions including SNI and certificate-status requests.
Proposed Standard2011
RFC 5246
RFC 8446
RFC 9325
Recommendations for Secure Use of TLS and DTLS
TLS and DTLS deployment guidance; review later protocol updates too.
Best Current Practice2022
RFC 8446
RFC 5246
Email
8
RFCTitleMaturity
Year
Related
RFC 9989
Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
DMARC validation and handling preferences; replaces RFC 7489 and 9091.
Proposed Standard2026
RFC 7489
RFC 9091
RFC 9990
Domain-Based Message Authentication, Reporting, and Conformance (DMARC) Aggregate Reporting
DMARC aggregate XML reports; replaces reporting rules in RFC 7489.
Proposed Standard2026
RFC 7489
RFC 9991
Domain-Based Message Authentication, Reporting, and Conformance (DMARC) Failure Reporting
DMARC individual-message failure reports; replaces RFC 7489 and updates 6591.
Proposed Standard2026
RFC 7489
RFC 5321
Simple Mail Transfer Protocol (SMTP)
Mail transfer commands and server-to-server delivery behavior.
Draft Standard2008
RFC 5322
RFC 5322
Internet Message Format
Internet email message headers and body syntax.
Draft Standard2008
RFC 5321
RFC 7208
Sender Policy Framework (SPF)
Authorize sending hosts for an email envelope domain.
Proposed Standard2014
RFC 6376
RFC 7489
RFC 6376
DomainKeys Identified Mail (DKIM)
Domain-associated digital signatures over email headers and body.
Internet Standard2011
RFC 7208
RFC 7489
RFC 7489
DMARC
Earlier DMARC specification; replaced by RFC 9989, 9990 and 9991.
Informational2015
RFC 7208
RFC 6376
Security - OAuth
9
RFCTitleMaturity
Year
Related
RFC 9700
Best Current Practice for OAuth 2.0 Security
OAuth security guidance: use PKCE S256; do not use password grants.
Best Current Practice2025
RFC 6749
RFC 6750
RFC 7636
RFC 6749
OAuth 2.0 Authorization Framework
Delegated authorization framework; apply RFC 9700 security guidance.
Proposed Standard2012
RFC 6750
RFC 7636
RFC 8252
RFC 6750
OAuth 2.0 Bearer Token Usage
Bearer token transport; possession enables use, so protect tokens.
Proposed Standard2012
RFC 6749
RFC 7636
PKCE - Proof Key for Code Exchange
Bind authorization-code redemption to a verifier; prefer S256.
Proposed Standard2015
RFC 6749
RFC 8252
OAuth 2.0 for Native Apps
OAuth guidance for native apps using external user agents.
Best Current Practice2017
RFC 6749
RFC 7636
RFC 7662
OAuth 2.0 Token Introspection
Query authorization servers for token state and metadata.
Proposed Standard2015
RFC 6749
RFC 6750
RFC 7009
OAuth 2.0 Token Revocation
Endpoint for revoking previously issued OAuth tokens.
Proposed Standard2013
RFC 6749
RFC 8693
OAuth 2.0 Token Exchange
OAuth token exchange for delegation and impersonation scenarios.
Proposed Standard2020
RFC 6749
RFC 8414
OAuth 2.0 Authorization Server Metadata
OAuth server capabilities and endpoints in JSON metadata.
Proposed Standard2018
RFC 6749
Security - JOSE
7
RFCTitleMaturity
Year
Related
RFC 8725
JSON Web Token Best Current Practices
Validate JWT algorithms, keys, issuer and audience; decoding is not verification.
Best Current Practice2020
RFC 7519
RFC 7515
RFC 7519
JSON Web Token (JWT)
Compact claims format carried in JWS or JWE.
Proposed Standard2015
RFC 7515
RFC 7516
RFC 7517
RFC 7518
RFC 7515
JSON Web Signature (JWS)
JSON-based signed or MAC-protected content.
Proposed Standard2015
RFC 7516
RFC 7517
RFC 7518
RFC 7519
RFC 7516
JSON Web Encryption (JWE)
JSON-based authenticated encryption for confidential content.
Proposed Standard2015
RFC 7515
RFC 7517
RFC 7518
RFC 7519
RFC 7517
JSON Web Key (JWK)
JSON representations of cryptographic keys and key sets.
Proposed Standard2015
RFC 7515
RFC 7516
RFC 7518
RFC 7519
RFC 7518
JSON Web Algorithms (JWA)
Algorithm identifiers and requirements for JOSE cryptography.
Proposed Standard2015
RFC 7515
RFC 7516
RFC 7517
RFC 7519
RFC 9421
HTTP Message Signatures
Sign selected HTTP message components using a signature base.
Proposed Standard2024
Security - Identity
1
RFCTitleMaturity
Year
Related
RFC 7033
WebFinger
Discover entity information, including OpenID Connect issuer discovery.
Proposed Standard2013
HTTP
14
RFCTitleMaturity
Year
Related
RFC 9110
HTTP Semantics
HTTP methods, status codes, fields and representation semantics.
Internet Standard2022
RFC 9111
RFC 9112
RFC 9113
RFC 9111
HTTP Caching
HTTP cache operation, validation and cache-control fields.
Internet Standard2022
RFC 9110
RFC 9112
HTTP/1.1
HTTP/1.1 message syntax, framing and connection management.
Internet Standard2022
RFC 9110
RFC 9113
HTTP/2
Multiplexed HTTP/2 streams and connection behavior.
Proposed Standard2022
RFC 9110
RFC 7541
RFC 9114
HTTP/3
HTTP/3 mapping over QUIC; stream loss remains independent.
Proposed Standard2022
RFC 9110
RFC 9000
RFC 7541
HPACK: Header Compression for HTTP/2
HTTP/2 header compression with static and dynamic tables.
Proposed Standard2015
RFC 9113
RFC 7231
HTTP/1.1: Semantics and Content (Superseded)
Earlier HTTP semantics specification, obsoleted by RFC 9110.
Replaced by: RFC 9110
Proposed Standard2014
RFC 9110
RFC 4918
HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)
WebDAV authoring, properties, collections and locking; not the source of 102.
Proposed Standard2007
RFC 9110
RFC 5842
RFC 5789
PATCH Method for HTTP
Partial resource modification through HTTP PATCH.
Proposed Standard2010
RFC 9110
RFC 7725
An HTTP Status Code to Report Legal Obstacles (451)
HTTP 451 indicates access denied because of a legal demand.
Proposed Standard2016
RFC 9110
RFC 9293
Transmission Control Protocol (TCP)
TCP transport specification consolidating earlier requirements and corrections.
Internet Standard2022
RFC 9457
Problem Details for HTTP APIs
Structured HTTP problem details in JSON or XML.
Proposed Standard2023
RFC 7807
RFC 9110
RFC 9530
Digest Fields
Content-Digest and Repr-Digest fields for HTTP integrity information.
Proposed Standard2024
RFC 9421
RFC 9651
RFC 9651
Structured Field Values for HTTP
Typed HTTP field values: items, lists and dictionaries.
Proposed Standard2024
RFC 9421
RFC 9530
Security - Web
4
RFCTitleMaturity
Year
Related
RFC 6797
HTTP Strict Transport Security (HSTS)
Tell browsers to require HTTPS for a host.
Proposed Standard2012
RFC 7469
HTTP Public Key Pinning (HPKP)
Historical browser key-pinning mechanism; RFC maturity is a separate property.
Proposed Standard2015
RFC 6797
RFC 7034
HTTP Header Field X-Frame-Options
Frame-embedding restrictions through the X-Frame-Options response header.
Informational2013
RFC 6454
The Web Origin Concept
Origins provide a security boundary for web content.
Proposed Standard2011
RFC 6455
Web Protocols
3
RFCTitleMaturity
Year
Related
RFC 6455
The WebSocket Protocol
Bidirectional messaging protocol established through a WebSocket handshake.
Proposed Standard2011
RFC 3986
Uniform Resource Identifier (URI)
Generic URI syntax and relative-reference resolution.
Internet Standard2005
RFC 6570
RFC 6570
URI Template
Expand variables into URI templates.
Proposed Standard2012
RFC 3986
DNS
4
RFCTitleMaturity
Year
Related
RFC 1035
Domain Names - Implementation and Specification
DNS wire messages, resource records and implementation rules.
Internet Standard1987
RFC 1034
RFC 8484
DNS Queries over HTTPS (DoH)
Transport DNS queries and responses over HTTPS.
Proposed Standard2018
RFC 1035
RFC 7858
RFC 7858
DNS over TLS (DoT)
Encrypt DNS transport using TLS, normally on port 853.
Proposed Standard2016
RFC 1035
RFC 8484
RFC 9460
Service Binding (SVCB) and HTTPS DNS Records
SVCB and HTTPS DNS records for service connection information.
Proposed Standard2023
RFC 1035
Data Formats
8
RFCTitleMaturity
Year
Related
RFC 8259
The JavaScript Object Notation (JSON) Data Interchange Format
JSON data interchange syntax and interoperability considerations.
Internet Standard2017
RFC 6901
RFC 6902
RFC 6901
JavaScript Object Notation (JSON) Pointer
Identify a value within a JSON document.
Proposed Standard2013
RFC 8259
RFC 6902
RFC 6902
JavaScript Object Notation (JSON) Patch
Apply ordered add, remove, replace, move, copy and test operations.
Proposed Standard2013
RFC 8259
RFC 6901
RFC 7396
JSON Merge Patch
Describe JSON updates by example; null removes object members.
Proposed Standard2014
RFC 8259
RFC 6902
RFC 4648
Base Encodings (Base16, Base32, Base64)
Base16, Base32, Base64 and URL-safe Base64 encoding rules.
Proposed Standard2006
RFC 3339
Date and Time on the Internet: Timestamps
Internet timestamp profile with dates, times and numeric offsets.
Proposed Standard2002
RFC 9562
Universally Unique IDentifiers (UUIDs)
UUID formats and generation, including versions 6, 7 and 8.
Proposed Standard2024
RFC 4122
RFC 9512
YAML Media Type
Registers application/yaml and describes YAML security considerations.
Informational2024
API Standards
1
RFCTitleMaturity
Year
Related
RFC 7807
Problem Details for HTTP APIs
Earlier HTTP problem-details format, obsoleted by RFC 9457.
Replaced by: RFC 9457
Proposed Standard2016
Transport
2
RFCTitleMaturity
Year
Related
RFC 9000
QUIC: A UDP-Based Multiplexed and Secure Transport
Secure multiplexed transport over UDP with connection migration.
Proposed Standard2021
RFC 9001
RFC 9114
RFC 9001
Using TLS to Secure QUIC
Use TLS handshake and key derivation to secure QUIC.
Proposed Standard2021
RFC 9000
RFC 8446
Cryptography
6
RFCTitleMaturity
Year
Related
RFC 8017
PKCS #1: RSA Cryptography Specifications
RSA encryption and signature encodings, including OAEP and PSS.
Informational2016
RFC 7748
Elliptic Curves for Security (Curve25519, Curve448)
X25519 and X448 elliptic-curve key agreement.
Informational2016
RFC 8032
RFC 8032
Edwards-Curve Digital Signature Algorithm (EdDSA)
Ed25519 and Ed448 digital signature algorithms.
Informational2017
RFC 7748
RFC 9106
Argon2 Memory-Hard Function for Password Hashing
Argon2 password hashing and memory-hard key derivation.
Informational2021
RFC 7914
The scrypt Password-Based Key Derivation Function
scrypt password-based, memory-hard key derivation.
Informational2016
RFC 9580
OpenPGP
OpenPGP message, key, encryption and signature formats.
Proposed Standard2024
RFC 4880
RFC Editor metadata checked 2026-10-21; follow primary links for later updates.
Quick Reference: Key RFC Families
JOSE family
RFC 7519
RFC 7515
RFC 7516
RFC 7517
RFC 7518
OAuth 2.0 family
RFC 6749
RFC 6750
RFC 7636
RFC 7662
RFC 8414
RFC 9700
HTTP specifications
RFC 9110
RFC 9111
RFC 9112
RFC 9113
RFC 9114
Email authentication
RFC 7208
RFC 6376
RFC 9989
RFC 9990
RFC 9991