Bitstring Status List & Revocation Decoder
Decode gzipped W3C Bitstring Status Lists and inspect credential revocation status at any bit index (0–100,000+) in real time.
0 indicates the credential is active & valid. Bit position 1 indicates the credential has been revoked or suspended by the issuer.
What this tool does
It decodes the encoded bitstrings used by W3C Bitstring Status List — the revocation mechanism behind many verifiable credential systems, in which one small compressed list holds the status of a hundred thousand credentials, one bit each. Paste the encodedList value and a credential's status index, and the full pipeline runs in your browser: base64 or base64url decoding (a multibase u prefix is tolerated), gzip decompression through the browser's native DecompressionStream, and the bit read itself. Bit 0 at your index means the credential is still active; bit 1 means revoked or suspended. A raw string of 0s and 1s is also accepted if you want to experiment without encoding a list first.
How to use it
- Paste the encoded list — the value you would find in a status list credential's
encodedListfield. A sample list ships in the page and decodes immediately on load. - Enter the credential's status list index, a plain integer.
- Press Inspect Status Bit Index. The badge reports the bit; the capacity line shows how many bit positions the list holds.
Where your data goes
Nowhere. Decoding uses atob and DecompressionStream — both built into the browser — plus plain JavaScript. The tool never fetches a status list for you and never stores what you paste; reload and it's gone.
Who it's for
Verifier implementers debugging why a revocation check returns the wrong answer; issuers confirming that the list they published actually encodes the statuses they intended; and anyone who wants to see what is really inside one of these lists — a gzipped bit-vector where each credential occupies exactly one bit. It is also the quickest way to answer "is this index even in range for this list?"
Honest limits
- You bring the list. The tool decodes what you paste; it does not fetch a
statusListURL or resolve a credential for you. - One bit, one binary answer. Whether a set bit means "revoked" or "suspended" depends on the credential's status purpose, which this tool does not parse — read the result alongside the credential.
- Single-bit lists. Newer multi-bit status entries (two or more bits per credential) read as plain bits here; the 0-means-valid semantics above are the single-bit model.
- Out-of-range indexes are reported as errors, not guessed as valid.
- DecompressionStream is required — every evergreen browser has it; a very old one gets a clear error message.
Questions people ask
Where do I find the encoded list and the index?
In the credential's credentialStatus block: it carries the statusListIndex and points at the status list credential that holds the list. Fetch that list with your own tooling, open it, and paste its encodedList string here.
Why is the list gzipped at all?
Because status lists are almost entirely zeros — most credentials are never revoked. Gzip squeezes a list holding a hundred thousand statuses into a few kilobytes, which is the entire trick that makes publishing one per issuer practical.
Back to the verifiers hub for the signature and structure tools.