What this does
Decodes a Windows Security Identifier (SID) — the S-1-5-21-... string Active Directory and Windows use to uniquely identify every user, group, and computer — into its revision, identifier authority, and sub-authority components, and recognizes universally well-known SIDs and RIDs like Everyone, NT AUTHORITY\SYSTEM, BUILTIN\Administrators, and Domain Admins. Entirely in your browser.
Why the last number matters most
A SID's structure is genuinely hierarchical: the identifier authority and most sub-authorities together identify which domain or authority issued the SID, and the final sub-authority — the RID — identifies which specific principal within that authority. Two SIDs that share every component except the last one belong to the same domain but different accounts or groups; recognizing a well-known RID like 512 (Domain Admins) or 500 (the built-in Administrator account) tells you what role a SID represents without needing to query the directory that issued it.
FAQ
What's the difference between a SID and a RID?
A SID (Security Identifier) is the complete identifier — every component together. A RID (Relative Identifier) is just the last sub-authority, unique only within the domain (or authority) that issued it. Two different domains' Domain Admins groups both end in RID 512, but their full SIDs differ because each domain has its own unique domain SID prefix.
Why does 512 mean "Domain Admins" but only sometimes?
Well-known RIDs like 512 only carry that meaning in the specific SID shape Windows assigns them — a domain SID (S-1-5-21-<domain>-512) for Domain Admins, or a BUILTIN SID (S-1-5-32-<rid>) for local groups like Administrators (544). The same number 512 appearing as a sub-authority in an unrelated SID shape means nothing special — the RID only carries meaning in context.
Can two different SIDs belong to the same well-known identity?
Every domain gets its own unique domain SID prefix, so "S-1-5-21-A-B-C-512" for one domain's Domain Admins and "S-1-5-21-X-Y-Z-512" for another's are different SIDs referring to the same conceptual role, not the same identity. Purely local well-known SIDs like S-1-1-0 (Everyone) or S-1-5-18 (SYSTEM) are the same everywhere, with no domain-specific portion at all.
Why is the identifier authority usually 5?
5 identifies "NT Authority" — the issuing authority for the vast majority of Windows security principals, including every domain and local account SID you'll normally encounter. Other values exist (0 for a null authority, 1 for "World Authority" behind S-1-1-0), but 5 is what you'll see in nearly every real SID from a domain-joined environment.
Does this tool look up a SID against a live directory?
No — it only decodes the SID's own structure and recognizes SIDs that are universally well-known (fixed values Windows itself defines, like Everyone or the BUILTIN\Administrators RID). It has no way to resolve an arbitrary domain-specific RID like 1013 to an actual username, since that mapping only exists inside the directory that issued it.
Try it yourself
Working with group membership rather than individual identities? AD Security Group Nesting Analyzer flattens nested group membership and flags circular references.