# LDAP filter explainer

> Paste an LDAP search filter - get the annotated tree: operators, match types, decoded RFC 4515 escapes, recognized AD matching-rule OIDs, and errors anchored to the exact character.

- Tool: https://ronutz.com/en/tools/ldap-filter-explainer
- Family: Identity & tokens

---

# LDAP filter explainer

Paste any LDAP search filter and this tool parses it exactly the way a directory server does - per RFC 4515, the string representation every LDAP client, PingDirectory search, PingFederate datastore lookup, and Active Directory query ultimately compiles into.

## What you get

The annotated tree. Each AND (`&`), OR (`|`), and NOT (`!`) node states its rule in plain language; each leaf item is classified by match type - equality, presence (`=*`), substring (wildcards, with initial/contains/ends-with parts in order), `>=`, `<=`, approximate (`~=`), or extensible match. RFC 4515 hex escapes (`\2a`, `\28`, `\29`, `\5c`) are decoded and listed. The famous Active Directory matching-rule OIDs are recognized by name: `1.2.840.113556.1.4.803` (bit-AND - the classic disabled-account test `(userAccountControl:1.2.840.113556.1.4.803:=2)`), `804` (bit-OR), and `1941` (transitive group membership).

## Errors are anchored

A malformed filter fails with the exact character position and a caret under it - the unbalanced parenthesis, the item without `=`, the backslash missing its two hex digits.

## Privacy

Filters often contain internal attribute names and OU structure. Everything is parsed locally in your browser; nothing is transmitted.

## Standards and references

- [RFC 4515 - LDAP: String Representation of Search Filters](https://www.rfc-editor.org/rfc/rfc4515)
- [RFC 4511 - LDAP: The Protocol](https://www.rfc-editor.org/rfc/rfc4511)
- [Microsoft Learn - Search Filter Syntax (AD matching-rule OIDs)](https://learn.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax)

## Related reading

- [LDAP search filters: reading the parentheses](https://ronutz.com/en/learn/ldap-search-filters.md): Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.