diff --git a/TODO.md b/TODO.md
index e4f247a..2d30e9d 100644
--- a/TODO.md
+++ b/TODO.md
@@ -94,7 +94,7 @@ Every new surface should feel like a GNOME 2 app that happens to speak `at://`.
 
 - [x] Add canonical `/repos/:did/...` routing.
 - [ ] Deepen Nautilus and gedit with collection controls plus record JSON/schema/info tabs.
-- [ ] Add Identity Inspector.
+- [x] Add Identity Inspector.
 - [ ] Add System Monitor with Jetstream first.
 - [ ] Add Network Map.
 - [ ] Add Archive Manager.
diff --git a/src/lib/atproto/identity-inspector.test.ts b/src/lib/atproto/identity-inspector.test.ts
new file mode 100644
index 0000000..7753820
--- /dev/null
+++ b/src/lib/atproto/identity-inspector.test.ts
@@ -0,0 +1,119 @@
+/** Move to test/inspector.test.ts */
+import { describe, expect, it } from 'vitest';
+import {
+	findHandleAlias,
+	findPdsEndpoint,
+	inspectIdentity,
+	normalizeHandle,
+	resolveDidDocumentUrl,
+	validateHandle
+} from './identity-inspector';
+import type { DidDocument } from './types';
+
+describe('identity inspector helpers', () => {
+	it('resolves supported DID document URLs', () => {
+		expect(resolveDidDocumentUrl('did:plc:xg2vq45muivyy3xwatcehspu')).toBe(
+			'https://plc.directory/did%3Aplc%3Axg2vq45muivyy3xwatcehspu'
+		);
+		expect(resolveDidDocumentUrl('did:web:example.com:user')).toBe('https://example.com/user/.well-known/did.json');
+	});
+
+	it('normalizes handle aliases and PDS services', () => {
+		expect(normalizeHandle('@DesertThunder.Dev')).toBe('desertthunder.dev');
+		expect(findHandleAlias(['at://desertthunder.dev'])).toBe('desertthunder.dev');
+		expect(
+			findPdsEndpoint([
+				{ id: '#atproto_pds', type: 'AtprotoPersonalDataServer', serviceEndpoint: 'https://pds.example.com' }
+			])
+		).toBe('https://pds.example.com');
+	});
+
+	it('classifies handle validation responses', async () => {
+		const client = {
+			get: async (name: string, _init?: unknown) => {
+				if (name === 'com.atproto.identity.resolveHandle') {
+					return { ok: true, data: { did: 'did:plc:example' } };
+				}
+
+				throw new Error('Unexpected XRPC call');
+			}
+		};
+		const fetcher = async (input: RequestInfo | URL) => {
+			const url = String(input);
+
+			if (url.includes('/.well-known/atproto-did')) {
+				return new Response('did:plc:other');
+			}
+
+			return Response.json({ Answer: [{ data: '"did=did:plc:example"' }] });
+		};
+
+		const validation = await validateHandle('desertthunder.dev', 'did:plc:example', client, fetcher);
+
+		expect(validation.resolveHandle.status).toBe('valid');
+		expect(validation.wellKnown.status).toBe('mismatch');
+		expect(validation.dnsTxt.status).toBe('valid');
+	});
+
+	it('builds an inspection model from atcute DID resolution and PLC audit', async () => {
+		const didDocument: DidDocument = {
+			id: 'did:plc:example',
+			alsoKnownAs: ['at://desertthunder.dev'],
+			verificationMethod: [
+				{
+					id: 'did:plc:example#atproto',
+					type: 'Multikey',
+					controller: 'did:plc:example',
+					publicKeyMultibase: 'zExample'
+				}
+			],
+			service: [{ id: '#atproto_pds', type: 'AtprotoPersonalDataServer', serviceEndpoint: 'https://pds.example.com' }]
+		};
+		const client = {
+			get: async (name: string, _init?: unknown) => {
+				if (name === 'com.atproto.identity.resolveDid') {
+					return { ok: true, data: { didDoc: didDocument } };
+				}
+
+				if (name === 'com.atproto.identity.resolveHandle') {
+					return { ok: true, data: { did: 'did:plc:example' } };
+				}
+
+				throw new Error('Unexpected XRPC call');
+			}
+		};
+		const fetcher = async (input: RequestInfo | URL) => {
+			const url = String(input);
+
+			if (url.endsWith('/log/audit')) {
+				return Response.json([
+					{
+						cid: 'bafyold',
+						nullified: false,
+						createdAt: '2024-01-01T00:00:00.000Z',
+						operation: { rotationKeys: ['did:key:old'] }
+					},
+					{
+						cid: 'bafynew',
+						nullified: false,
+						createdAt: '2024-02-01T00:00:00.000Z',
+						operation: { rotationKeys: ['did:key:new'] }
+					}
+				]);
+			}
+
+			if (url.includes('/.well-known/atproto-did')) {
+				return new Response('did:plc:example');
+			}
+
+			return Response.json({ Answer: [] });
+		};
+
+		const inspection = await inspectIdentity('did:plc:example', null, { client, fetcher });
+
+		expect(inspection.handle).toBe('desertthunder.dev');
+		expect(inspection.pds).toBe('https://pds.example.com');
+		expect(inspection.rotationKeys).toEqual(['did:key:new']);
+		expect(inspection.handleValidation?.wellKnown.status).toBe('valid');
+	});
+});
diff --git a/src/lib/atproto/identity-inspector.ts b/src/lib/atproto/identity-inspector.ts
new file mode 100644
index 0000000..38b9c66
--- /dev/null
+++ b/src/lib/atproto/identity-inspector.ts
@@ -0,0 +1,270 @@
+/** TODO: this should be identity/inspector.ts */
+import { Client, simpleFetchHandler } from '@atcute/client';
+import type { Did, Handle } from '@atcute/lexicons/syntax';
+import type {} from '@atcute/atproto';
+import type { DidDocument, DidService, DidVerificationMethod } from './types';
+
+export type IdentityValidationStatus = 'valid' | 'mismatch' | 'unavailable' | 'unsupported';
+
+export type HandleValidation = {
+	handle: string;
+	resolveHandle: IdentityCheck;
+	wellKnown: IdentityCheck;
+	dnsTxt: IdentityCheck;
+};
+
+export type IdentityCheck = { status: IdentityValidationStatus; label: string; detail: string; value: string | null };
+
+export type PlcAuditEntry = {
+	cid: string;
+	createdAt: string;
+	nullified: boolean;
+	operation: {
+		alsoKnownAs?: string[];
+		rotationKeys?: string[];
+		verificationMethods?: Record<string, string>;
+		services?: Record<string, { type?: string; endpoint?: string }>;
+	};
+};
+
+export type IdentityInspection = {
+	did: string;
+	handle: string | null;
+	didDocument: DidDocument;
+	aliases: string[];
+	services: DidService[];
+	verificationMethods: DidVerificationMethod[];
+	rotationKeys: string[];
+	pds: string | null;
+	didDocumentUrl: string;
+	plcAuditUrl: string | null;
+	handleValidation: HandleValidation | null;
+	rawJson: string;
+};
+
+type IdentityClient = { get: (name: string, init?: unknown) => Promise<unknown> };
+
+export type ResolveDidDocumentOptions = { client?: IdentityClient; fetcher?: typeof fetch };
+
+type InspectIdentityOptions = ResolveDidDocumentOptions;
+
+const publicApi = new Client({ handler: simpleFetchHandler({ service: 'https://public.api.bsky.app' }) });
+const publicIdentityApi = publicApi as unknown as IdentityClient;
+
+export async function inspectIdentity(
+	did: string,
+	fallbackHandle: string | null = null,
+	options: InspectIdentityOptions = {}
+): Promise<IdentityInspection> {
+	if (!did.startsWith('did:')) {
+		throw new Error('Identity Inspector requires a DID.');
+	}
+
+	const client = options.client ?? publicIdentityApi;
+	const fetcher = options.fetcher ?? fetch;
+	const didDocumentUrl = resolveDidDocumentUrl(did);
+	const didDocument = await resolveDidDocument(did, { client, fetcher });
+	const aliases = didDocument.alsoKnownAs ?? [];
+	const handle = findHandleAlias(aliases) ?? normalizeHandle(fallbackHandle);
+	const services = didDocument.service ?? [];
+	const verificationMethods = didDocument.verificationMethod ?? [];
+	const pds = findPdsEndpoint(services);
+	const audit = did.startsWith('did:plc:') ? await fetchPlcAudit(did, fetcher).catch(() => []) : [];
+	const latestOperation = audit.at(-1)?.operation;
+	const rotationKeys = latestOperation?.rotationKeys ?? [];
+
+	return {
+		did,
+		handle,
+		didDocument,
+		aliases,
+		services,
+		verificationMethods,
+		rotationKeys,
+		pds,
+		didDocumentUrl,
+		plcAuditUrl: did.startsWith('did:plc:') ? `${didDocumentUrl}/log/audit` : null,
+		handleValidation: handle ? await validateHandle(handle, did, client, fetcher) : null,
+		rawJson: JSON.stringify(didDocument, null, 2)
+	};
+}
+
+export async function validateHandle(
+	handle: string,
+	did: string,
+	client: IdentityClient = publicIdentityApi,
+	fetcher: typeof fetch = fetch
+): Promise<HandleValidation> {
+	const normalizedHandle = normalizeHandle(handle);
+
+	if (!normalizedHandle) {
+		throw new Error('Handle is empty.');
+	}
+
+	const [resolveHandle, wellKnown, dnsTxt] = await Promise.all([
+		validateResolveHandle(normalizedHandle, did, client),
+		validateWellKnown(normalizedHandle, did, fetcher),
+		validateDnsTxt(normalizedHandle, did, fetcher)
+	]);
+
+	return { handle: normalizedHandle, resolveHandle, wellKnown, dnsTxt };
+}
+
+export function resolveDidDocumentUrl(did: string) {
+	if (did.startsWith('did:plc:')) {
+		return `https://plc.directory/${encodeURIComponent(did)}`;
+	}
+
+	if (did.startsWith('did:web:')) {
+		const domain = did.slice('did:web:'.length).replaceAll(':', '/');
+		return `https://${domain}/.well-known/did.json`;
+	}
+
+	throw new Error(`Unsupported DID method: ${did}`);
+}
+
+export function findPdsEndpoint(services: DidService[]) {
+	const pdsService = services.find(
+		(service) => service.id === '#atproto_pds' || service.type === 'AtprotoPersonalDataServer'
+	);
+	const endpoint = pdsService?.serviceEndpoint;
+
+	return typeof endpoint === 'string' ? endpoint : null;
+}
+
+export function findHandleAlias(aliases: string[]) {
+	const alias = aliases.find((value) => value.startsWith('at://'));
+	return alias ? normalizeHandle(alias.slice('at://'.length)) : null;
+}
+
+export function normalizeHandle(handle: string | null | undefined) {
+	const normalized = handle?.trim().replace(/^@/, '').toLowerCase();
+	return normalized || null;
+}
+
+export async function resolveDidDocument(did: string, options: ResolveDidDocumentOptions = {}): Promise<DidDocument> {
+	const client = options.client ?? publicIdentityApi;
+	const fetcher = options.fetcher ?? fetch;
+
+	try {
+		const result = unwrapXrpcData(
+			await client.get('com.atproto.identity.resolveDid', { params: { did: did as Did } })
+		) as { didDoc: unknown };
+		return result.didDoc as DidDocument;
+	} catch {
+		const response = await fetcher(resolveDidDocumentUrl(did));
+
+		if (!response.ok) {
+			throw new Error(`Could not fetch DID document (${response.status}).`);
+		}
+
+		return (await response.json()) as DidDocument;
+	}
+}
+
+async function validateResolveHandle(handle: string, did: string, client: IdentityClient): Promise<IdentityCheck> {
+	try {
+		const result = unwrapXrpcData(
+			await client.get('com.atproto.identity.resolveHandle', { params: { handle: handle as Handle } })
+		) as { did: string };
+		const status = result.did === did ? 'valid' : 'mismatch';
+
+		return {
+			status,
+			label: 'XRPC resolveHandle',
+			detail:
+				status === 'valid'
+					? 'Public ATProto resolver matches this DID.'
+					: 'Public ATProto resolver returned a different DID.',
+			value: result.did
+		};
+	} catch {
+		return unavailableCheck('XRPC resolveHandle', 'Could not resolve this handle through public.api.bsky.app.');
+	}
+}
+
+async function validateWellKnown(handle: string, did: string, fetcher: typeof fetch): Promise<IdentityCheck> {
+	try {
+		const response = await fetcher(`https://${handle}/.well-known/atproto-did`);
+
+		if (!response.ok) {
+			return unavailableCheck('.well-known', `HTTP ${response.status} from the handle well-known endpoint.`);
+		}
+
+		const value = (await response.text()).trim();
+		const status = value === did ? 'valid' : 'mismatch';
+
+		return {
+			status,
+			label: '.well-known',
+			detail:
+				status === 'valid'
+					? 'Handle well-known file asserts this DID.'
+					: 'Endpoint responded, but did not assert this DID.',
+			value: value.slice(0, 160)
+		};
+	} catch {
+		return unavailableCheck('.well-known', 'Could not fetch the handle well-known endpoint.');
+	}
+}
+
+async function validateDnsTxt(handle: string, did: string, fetcher: typeof fetch): Promise<IdentityCheck> {
+	try {
+		const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(`_atproto.${handle}`)}&type=TXT`;
+		const response = await fetcher(url, { headers: { accept: 'application/dns-json' } });
+
+		if (!response.ok) {
+			return unavailableCheck('DNS TXT', `DNS-over-HTTPS returned HTTP ${response.status}.`);
+		}
+
+		const data = (await response.json()) as { Answer?: Array<{ data?: string }> };
+		const values = data.Answer?.map((answer) => answer.data ?? '').map(stripDnsTxtQuotes) ?? [];
+		const assertion = values.find((value) => value.startsWith('did='));
+
+		if (!assertion) {
+			return unavailableCheck('DNS TXT', 'No _atproto TXT DID assertion was found.');
+		}
+
+		const value = assertion.slice('did='.length);
+		const status = value === did ? 'valid' : 'mismatch';
+
+		return {
+			status,
+			label: 'DNS TXT',
+			detail: status === 'valid' ? 'DNS TXT record asserts this DID.' : 'DNS TXT record asserts a different DID.',
+			value
+		};
+	} catch {
+		return unavailableCheck('DNS TXT', 'Could not query DNS-over-HTTPS for this handle.');
+	}
+}
+
+async function fetchPlcAudit(did: string, fetcher: typeof fetch): Promise<PlcAuditEntry[]> {
+	const response = await fetcher(`${resolveDidDocumentUrl(did)}/log/audit`);
+
+	if (!response.ok) {
+		return [];
+	}
+
+	return (await response.json()) as PlcAuditEntry[];
+}
+
+function unavailableCheck(label: string, detail: string): IdentityCheck {
+	return { status: 'unavailable', label, detail, value: null };
+}
+
+function stripDnsTxtQuotes(value: string) {
+	return value.replace(/^"|"$/g, '').replaceAll('" "', '');
+}
+
+function unwrapXrpcData(response: unknown) {
+	if (typeof response !== 'object' || response === null) {
+		throw new Error('Invalid XRPC response.');
+	}
+
+	if (!('ok' in response) || response.ok !== true || !('data' in response)) {
+		throw new Error('XRPC request failed.');
+	}
+
+	return response.data;
+}
diff --git a/src/lib/atproto/identity.ts b/src/lib/atproto/identity.ts
index 4c32be3..d723f88 100644
--- a/src/lib/atproto/identity.ts
+++ b/src/lib/atproto/identity.ts
@@ -3,9 +3,8 @@ import type { ActorIdentifier } from '@atcute/lexicons/syntax';
 import type { Handle } from '@atcute/lexicons/syntax';
 import type {} from '@atcute/atproto';
 import type {} from '@atcute/bluesky';
-import type { AccountIdentity, ActorTypeaheadResult, DidDocument } from './types';
-
-export type { AccountIdentity, ActorTypeaheadResult } from './types';
+import { findPdsEndpoint, resolveDidDocument } from './identity-inspector';
+import type { AccountIdentity, ActorTypeaheadResult } from './types';
 
 export const defaultIdentity = { handle: 'desertthunder.dev', did: 'did:plc:xg2vq45muivyy3xwatcehspu' };
 
@@ -76,30 +75,6 @@ async function getPublicProfile(actor: string) {
 }
 
 async function resolvePds(did: string): Promise<string | null> {
-	const response = await fetch(resolveDidDocumentUrl(did));
-
-	if (!response.ok) {
-		return null;
-	}
-
-	const document = (await response.json()) as DidDocument;
-	const pdsService = document.service?.find(
-		(service) => service.id === '#atproto_pds' || service.type === 'AtprotoPersonalDataServer'
-	);
-	const endpoint = pdsService?.serviceEndpoint;
-
-	return typeof endpoint === 'string' ? endpoint : null;
-}
-
-function resolveDidDocumentUrl(did: string) {
-	if (did.startsWith('did:plc:')) {
-		return `https://plc.directory/${encodeURIComponent(did)}`;
-	}
-
-	if (did.startsWith('did:web:')) {
-		const domain = did.slice('did:web:'.length).replaceAll(':', '/');
-		return `https://${domain}/.well-known/did.json`;
-	}
-
-	throw new Error(`Unsupported DID method: ${did}`);
+	const document = await resolveDidDocument(did);
+	return findPdsEndpoint(document.service ?? []);
 }
diff --git a/src/lib/atproto/routes.test.ts b/src/lib/atproto/routes.test.ts
index de201e7..77f00d5 100644
--- a/src/lib/atproto/routes.test.ts
+++ b/src/lib/atproto/routes.test.ts
@@ -1,5 +1,6 @@
+/** Move to test/routes.test.ts */
 import { describe, expect, it } from 'vitest';
-import { collectionPath, recordPath, repoPath } from './routes';
+import { collectionPath, identityPath, recordPath, repoPath } from './routes';
 
 describe('ATProto route helpers', () => {
 	it('builds canonical repo routes', () => {
@@ -12,6 +13,10 @@ describe('ATProto route helpers', () => {
 		);
 	});
 
+	it('builds canonical identity inspector routes', () => {
+		expect(identityPath('did:plc:abc123')).toBe('/repos/did:plc:abc123/identity');
+	});
+
 	it('encodes record keys in canonical record routes', () => {
 		expect(recordPath({ did: 'did:plc:abc123', collection: 'app.bsky.feed.post', rkey: 'post/key' })).toBe(
 			'/repos/did:plc:abc123/collections/app.bsky.feed.post/post%2Fkey'
diff --git a/src/lib/atproto/routes.ts b/src/lib/atproto/routes.ts
index 1814f22..97fcce0 100644
--- a/src/lib/atproto/routes.ts
+++ b/src/lib/atproto/routes.ts
@@ -6,6 +6,10 @@ export function repoPath(did: string) {
 	return `/repos/${did}`;
 }
 
+export function identityPath(did: string) {
+	return `${repoPath(did)}/identity`;
+}
+
 export function collectionPath({ did, collection }: CollectionRouteParams) {
 	return `${repoPath(did)}/collections/${collection}`;
 }
diff --git a/src/lib/atproto/types.ts b/src/lib/atproto/types.ts
index 0f8a253..d99eeed 100644
--- a/src/lib/atproto/types.ts
+++ b/src/lib/atproto/types.ts
@@ -10,7 +10,24 @@ export type AccountIdentity = {
 export type ActorTypeaheadResult = Pick<AccountIdentity, 'handle' | 'did' | 'displayName' | 'avatar'>;
 
 export type DidDocument = {
-	service?: Array<{ id?: string; type?: string; serviceEndpoint?: string | string[] | Record<string, unknown> }>;
+	'@context'?: unknown;
+	id?: string;
+	alsoKnownAs?: string[];
+	verificationMethod?: DidVerificationMethod[];
+	service?: DidService[];
+};
+
+export type DidService = {
+	id?: string;
+	type?: string;
+	serviceEndpoint?: string | string[] | Record<string, unknown>;
+};
+
+export type DidVerificationMethod = {
+	id?: string;
+	type?: string;
+	controller?: string;
+	publicKeyMultibase?: string;
 };
 
 export type CollectionSummary = { name: string; icon: string; appLabel: string | null; loadedCount: number | null };
diff --git a/src/lib/components/CollectionBrowser.svelte b/src/lib/components/CollectionBrowser.svelte
index 74a1baa..4b38d43 100644
--- a/src/lib/components/CollectionBrowser.svelte
+++ b/src/lib/components/CollectionBrowser.svelte
@@ -3,7 +3,7 @@
 	import { onMount } from 'svelte';
 	import { accountSetup } from '$lib/atproto/setup.svelte';
 	import { repoBrowser } from '$lib/atproto/repo.svelte';
-	import { recordPath } from '$lib/atproto/routes';
+	import { identityPath, recordPath } from '$lib/atproto/routes';
 	import type { CollectionSummary, RepoRecordSummary } from '$lib/atproto/types';
 	import { windowManager } from '$lib/window-manager.svelte';
 	import { SvelteMap } from 'svelte/reactivity';
@@ -57,11 +57,16 @@
 		}
 	}
 
+	function openIdentityInspector() {
+		const identity = accountSetup.identity;
+		if (!identity) return;
+
+		void goto(identityPath(identity.did), { keepFocus: true, noScroll: true });
+	}
+
 	function groupCollections(collections: CollectionSummary[]) {
-		const groups = new SvelteMap<
-			string,
-			{ namespace: string; label: string; icon: string; collections: CollectionSummary[] }
-		>();
+		type M = { namespace: string; label: string; icon: string; collections: CollectionSummary[] };
+		const groups = new SvelteMap<string, M>();
 
 		for (const collection of collections) {
 			const namespace = namespaceForCollection(collection.name);
@@ -153,26 +158,36 @@
 					{/if}
 				</p>
 			</div>
-			<form
-				class="search-box"
-				role="search"
-				onsubmit={(event) => {
-					event.preventDefault();
-					searchRecords();
-				}}>
-				<label for="record-search">Search</label>
-				<div>
-					<input
-						id="record-search"
-						bind:value={searchQuery}
-						placeholder="Search records"
-						disabled={!repoBrowser.selectedCollection || repoBrowser.isLoadingRecords || repoBrowser.isSearching} />
-					<button type="submit" disabled={!searchQuery.trim() || repoBrowser.isSearching}>Search</button>
-					{#if repoBrowser.searchQuery}
-						<button type="button" class="clear-search" onclick={clearSearch}>Clear</button>
-					{/if}
-				</div>
-			</form>
+			<div class="summary-controls">
+				<form
+					class="search-box"
+					role="search"
+					onsubmit={(event) => {
+						event.preventDefault();
+						searchRecords();
+					}}>
+					<label for="record-search">Search</label>
+					<div>
+						<input
+							id="record-search"
+							bind:value={searchQuery}
+							placeholder="Search records"
+							disabled={!repoBrowser.selectedCollection || repoBrowser.isLoadingRecords || repoBrowser.isSearching} />
+						<button type="submit" disabled={!searchQuery.trim() || repoBrowser.isSearching}>Search</button>
+						{#if repoBrowser.searchQuery}
+							<button type="button" class="clear-search" onclick={clearSearch}>Clear</button>
+						{/if}
+					</div>
+				</form>
+				<button
+					class="identity-launcher"
+					type="button"
+					disabled={!accountSetup.identity}
+					onclick={openIdentityInspector}>
+					<img src="/icons/humanity/apps/identity-inspector.svg" alt="" width="22" height="22" />
+					<span>Identity</span>
+				</button>
+			</div>
 		</div>
 
 		<div class="record-list">
@@ -188,9 +203,11 @@
 				<p class="message">{repoBrowser.isSearching ? 'Searching cached records…' : 'Loading records…'}</p>
 			{:else if repoBrowser.records.length === 0}
 				<p class="message">
-					{repoBrowser.searchQuery
-						? 'No cached records matched that search.'
-						: 'No public records found for this collection.'}
+					{#if repoBrowser.searchQuery}
+						No cached records matched that search.
+					{:else}
+						No public records found for this collection.
+					{/if}
 				</p>
 			{:else}
 				{#each repoBrowser.records as record (record.uri)}
@@ -378,6 +395,7 @@
 		border-bottom: 1px solid #b29366;
 	}
 
+	.summary-controls,
 	.search-box {
 		display: grid;
 		gap: var(--space-1);
@@ -410,7 +428,8 @@
 		font-size: var(--text-1);
 	}
 
-	.search-box button {
+	.search-box button,
+	.identity-launcher {
 		padding: 0.35rem 0.55rem;
 		color: #2c180d;
 		background: linear-gradient(#fff8e8, #d3b17d);
@@ -422,8 +441,22 @@
 		font-weight: 700;
 	}
 
+	.identity-launcher {
+		display: inline-flex;
+		align-items: center;
+		justify-self: end;
+		gap: var(--space-1);
+		min-height: 1.9rem;
+		cursor: default;
+	}
+
+	.identity-launcher:active {
+		scale: 0.96;
+	}
+
 	.search-box button:disabled,
-	.search-box input:disabled {
+	.search-box input:disabled,
+	.identity-launcher:disabled {
 		opacity: 0.62;
 	}
 
diff --git a/src/lib/components/IdentityInspector.svelte b/src/lib/components/IdentityInspector.svelte
new file mode 100644
index 0000000..a7e135b
--- /dev/null
+++ b/src/lib/components/IdentityInspector.svelte
@@ -0,0 +1,599 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { accountSetup } from '$lib/atproto/setup.svelte';
+	import { inspectIdentity, type IdentityCheck, type IdentityInspection } from '$lib/atproto/identity-inspector';
+	import { errorMessage } from '$lib/utils/errors';
+
+	let inspection = $state<IdentityInspection | null>(null);
+	let selectedSection = $state<'overview' | 'aliases' | 'services' | 'keys' | 'raw'>('overview');
+	let isLoading = $state(false);
+	let error = $state<string | null>(null);
+	let copiedValue = $state<string | null>(null);
+
+	const identity = $derived(accountSetup.identity);
+	const keyrings = $derived.by(() => {
+		if (!inspection) return [];
+
+		return [
+			{ id: 'overview', label: 'Identity', icon: '/icons/humanity/status/network-wireless-encrypted.svg', count: 1 },
+			{ id: 'aliases', label: 'Handle aliases', icon: '/icons/humanity/places/user-home.svg', count: inspection.aliases.length },
+			{
+				id: 'services',
+				label: 'Services',
+				icon: '/icons/humanity/apps/internet-feed-reader.svg',
+				count: inspection.services.length
+			},
+			{
+				id: 'keys',
+				label: 'Verification keys',
+				icon: '/icons/humanity/status/network-wireless-encrypted.svg',
+				count: inspection.verificationMethods.length + inspection.rotationKeys.length
+			},
+			{ id: 'raw', label: 'DID document', icon: '/icons/humanity/mimes/text-x-generic.svg', count: 1 }
+		] as const;
+	});
+
+	onMount(() => {
+		void loadInspection();
+	});
+
+	async function loadInspection() {
+		if (!identity) {
+			error = 'No repository identity is configured.';
+			return;
+		}
+
+		isLoading = true;
+		error = null;
+
+		try {
+			inspection = await inspectIdentity(identity.did, identity.handle);
+		} catch (unknownError) {
+			error = errorMessage(unknownError, 'Could not inspect that identity.');
+		} finally {
+			isLoading = false;
+		}
+	}
+
+	async function copyValue(value: string | null | undefined) {
+		if (!value) return;
+
+		try {
+			await navigator.clipboard.writeText(value);
+			copiedValue = value;
+			window.setTimeout(() => {
+				if (copiedValue === value) copiedValue = null;
+			}, 1600);
+		} catch {
+			copiedValue = null;
+		}
+	}
+
+	function statusLabel(status: IdentityCheck['status']) {
+		if (status === 'valid') return 'Trusted';
+		if (status === 'mismatch') return 'Mismatch';
+		if (status === 'unsupported') return 'Unsupported';
+		return 'Unavailable';
+	}
+</script>
+
+<section class="identity-inspector" aria-label="Identity Inspector">
+	<aside class="keyring-sidebar" aria-label="Identity keyrings">
+		<header>
+			<img src="/icons/humanity/apps/identity-inspector.svg" alt="" width="36" height="36" />
+			<div>
+				<h2>Passwords and Encryption Keys</h2>
+				<p>{identity ? `@${identity.handle}` : 'No identity loaded'}</p>
+			</div>
+		</header>
+
+		<nav aria-label="Identity sections">
+			{#if keyrings.length === 0}
+				<p class="sidebar-empty">Loading keyrings...</p>
+			{:else}
+				{#each keyrings as keyring (keyring.id)}
+					<button
+						type="button"
+						class:active={selectedSection === keyring.id}
+						aria-current={selectedSection === keyring.id ? 'page' : undefined}
+						onclick={() => (selectedSection = keyring.id)}>
+						<img src={keyring.icon} alt="" width="24" height="24" />
+						<span>{keyring.label}</span>
+						<small>{keyring.count}</small>
+					</button>
+				{/each}
+			{/if}
+		</nav>
+	</aside>
+
+	<div class="detail-pane">
+		<div class="keyring-toolbar" aria-label="Identity actions">
+			<button type="button" onclick={loadInspection} disabled={isLoading}>
+				<img src="/icons/humanity/actions/mail-send-receive.svg" alt="" width="18" height="18" />
+				<span>{isLoading ? 'Refreshing' : 'Refresh'}</span>
+			</button>
+			<button type="button" onclick={() => copyValue(inspection?.did)} disabled={!inspection}>
+				<img src="/icons/humanity/mimes/text-x-generic.svg" alt="" width="18" height="18" />
+				<span>Copy DID</span>
+			</button>
+			{#if inspection?.pds}
+				<button type="button" onclick={() => window.open(inspection?.pds ?? '', '_blank', 'noopener,noreferrer')}>
+					<img src="/icons/humanity/apps/web-browser.svg" alt="" width="18" height="18" />
+					<span>Open PDS</span>
+				</button>
+			{/if}
+		</div>
+
+		{#if error}
+			<div class="inspector-message error">
+				<img src="/icons/humanity/status/network-wireless-encrypted.svg" alt="" width="32" height="32" />
+				<p>{error}</p>
+			</div>
+		{:else if isLoading || !inspection}
+			<div class="inspector-message">
+				<img src="/icons/humanity/status/network-wireless-encrypted.svg" alt="" width="32" height="32" />
+				<p>Unlocking public identity material...</p>
+			</div>
+		{:else}
+			<header class="identity-heading">
+				<img src={identity?.avatar ?? '/icons/humanity/status/network-wireless-encrypted.svg'} alt="" width="48" height="48" />
+				<div>
+					<p>Default public keyring</p>
+					<h2>{inspection.handle ? `@${inspection.handle}` : inspection.did}</h2>
+					<span>{inspection.did}</span>
+				</div>
+			</header>
+
+			{#if selectedSection === 'overview'}
+				<section class="property-section" aria-label="Identity overview">
+					<h3>Identity Properties</h3>
+					<div class="property-grid">
+						{@render PropertyRow('DID', inspection.did, copyValue, copiedValue === inspection.did)}
+						{@render PropertyRow(
+							'Handle',
+							inspection.handle ?? 'No handle alias',
+							copyValue,
+							copiedValue === inspection.handle
+						)}
+						{@render PropertyRow('PDS', inspection.pds ?? 'Not advertised', copyValue, copiedValue === inspection.pds)}
+						{@render PropertyRow(
+							'DID document',
+							inspection.didDocumentUrl,
+							copyValue,
+							copiedValue === inspection.didDocumentUrl
+						)}
+					</div>
+
+					{#if inspection.handleValidation}
+						<div class="validation-list" aria-label="Handle validation">
+							{#each [inspection.handleValidation.resolveHandle, inspection.handleValidation.wellKnown, inspection.handleValidation.dnsTxt] as check (check.label)}
+								<div class="validation-row" class:mismatch={check.status === 'mismatch'} class:valid={check.status === 'valid'}>
+									<img
+										src={check.status === 'valid'
+											? '/icons/humanity/status/network-wireless-encrypted.svg'
+											: check.status === 'mismatch'
+												? '/icons/humanity/status/audio-volume-medium.svg'
+												: '/icons/humanity/apps/identity-inspector.svg'}
+										alt=""
+										width="24"
+										height="24" />
+									<div>
+										<strong>{check.label}</strong>
+										<p>{check.detail}</p>
+										{#if check.value}
+											<code>{check.value}</code>
+										{/if}
+									</div>
+									<span>{statusLabel(check.status)}</span>
+								</div>
+							{/each}
+						</div>
+					{/if}
+				</section>
+			{:else if selectedSection === 'aliases'}
+				<section class="property-section" aria-label="Handle aliases">
+					<h3>Aliases</h3>
+					<div class="list-box">
+						{#each inspection.aliases as alias (alias)}
+							{@render PropertyRow('alsoKnownAs', alias, copyValue, copiedValue === alias)}
+						{:else}
+							<p class="empty-row">No aliases are listed in the DID document.</p>
+						{/each}
+					</div>
+				</section>
+			{:else if selectedSection === 'services'}
+				<section class="property-section" aria-label="Services">
+					<h3>Services</h3>
+					<div class="list-box">
+						{#each inspection.services as service, index (`${service.id}-${index}`)}
+							<div class="object-row">
+								<img src="/icons/humanity/apps/internet-feed-reader.svg" alt="" width="28" height="28" />
+								<div>
+									<strong>{service.id ?? 'Unnamed service'}</strong>
+									<p>{service.type ?? 'Unknown service type'}</p>
+									<code>{typeof service.serviceEndpoint === 'string' ? service.serviceEndpoint : JSON.stringify(service.serviceEndpoint)}</code>
+								</div>
+							</div>
+						{:else}
+							<p class="empty-row">No services are listed in the DID document.</p>
+						{/each}
+					</div>
+				</section>
+			{:else if selectedSection === 'keys'}
+				<section class="property-section" aria-label="Keys">
+					<h3>Verification Methods</h3>
+					<div class="list-box">
+						{#each inspection.verificationMethods as method, index (`${method.id}-${index}`)}
+							<div class="object-row">
+								<img src="/icons/humanity/status/network-wireless-encrypted.svg" alt="" width="28" height="28" />
+								<div>
+									<strong>{method.id ?? 'Unnamed verification method'}</strong>
+									<p>{method.type ?? 'Unknown key type'}</p>
+									<code>{method.publicKeyMultibase ?? method.controller ?? 'No public key material'}</code>
+								</div>
+							</div>
+						{:else}
+							<p class="empty-row">No verification methods are listed in the DID document.</p>
+						{/each}
+					</div>
+
+					<h3>Rotation Keys</h3>
+					<div class="list-box">
+						{#each inspection.rotationKeys as key (key)}
+							{@render PropertyRow('PLC rotation key', key, copyValue, copiedValue === key)}
+						{:else}
+							<p class="empty-row">No PLC rotation keys were available.</p>
+						{/each}
+					</div>
+				</section>
+			{:else}
+				<section class="property-section raw-section" aria-label="Raw DID document">
+					<h3>Raw DID Document</h3>
+					<pre>{inspection.rawJson}</pre>
+				</section>
+			{/if}
+		{/if}
+	</div>
+</section>
+
+{#snippet PropertyRow(label: string, value: string, oncopy: (value: string) => unknown, copied = false)}
+	<div class="property-row">
+		<dt>{label}</dt>
+		<dd>
+			<code>{value}</code>
+			<button type="button" onclick={() => oncopy(value)}>
+				<img src="/icons/humanity/mimes/text-x-generic.svg" alt="" width="16" height="16" />
+				<span>{copied ? 'Copied' : 'Copy'}</span>
+			</button>
+		</dd>
+	</div>
+{/snippet}
+
+<style>
+	.identity-inspector {
+		display: grid;
+		grid-template-columns: minmax(13rem, 16rem) minmax(0, 1fr);
+		height: 100%;
+		overflow: hidden;
+		color: #2f2218;
+		background: #f7f0e3;
+		border: 1px solid #8d7557;
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.7) inset;
+	}
+
+	.keyring-sidebar {
+		display: grid;
+		grid-template-rows: auto minmax(0, 1fr);
+		min-height: 0;
+		background: linear-gradient(90deg, #c9b38f, #e7d8bf);
+		border-right: 1px solid #8f704d;
+	}
+
+	.keyring-sidebar header {
+		display: flex;
+		gap: var(--space-2);
+		align-items: center;
+		padding: var(--space-3);
+		border-bottom: 1px solid #9a7b57;
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.5);
+	}
+
+	.keyring-sidebar h2 {
+		font-size: var(--text-2);
+		line-height: var(--leading-tight);
+		text-wrap: balance;
+	}
+
+	.keyring-sidebar p,
+	.sidebar-empty,
+	.identity-heading p,
+	.identity-heading span,
+	.validation-row p,
+	.object-row p,
+	.empty-row {
+		color: #68513a;
+		font-size: var(--text-1);
+	}
+
+	.keyring-sidebar nav {
+		display: grid;
+		align-content: start;
+		gap: 1px;
+		min-height: 0;
+		padding: var(--space-2);
+		overflow: auto;
+	}
+
+	.keyring-sidebar button {
+		display: grid;
+		grid-template-columns: 1.5rem minmax(0, 1fr) auto;
+		gap: var(--space-2);
+		align-items: center;
+		min-height: 2.35rem;
+		padding: var(--space-1) var(--space-2);
+		text-align: left;
+		border: 1px solid transparent;
+		border-radius: var(--radius-1);
+		cursor: default;
+	}
+
+	.keyring-sidebar button:hover,
+	.keyring-sidebar button.active {
+		background: linear-gradient(#f8edda, #cdb38e);
+		border-color: #fff8ea #987755 #765533 #f0dcc0;
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.72) inset;
+	}
+
+	.keyring-sidebar button span {
+		overflow: hidden;
+		text-overflow: ellipsis;
+		white-space: nowrap;
+	}
+
+	.keyring-sidebar small {
+		min-width: 1.4rem;
+		padding: 0 0.3rem;
+		color: #3b2919;
+		text-align: center;
+		background: #efe1c8;
+		border: 1px solid #a58a63;
+		border-radius: 999px;
+		box-shadow: var(--shadow-sunken);
+		font-variant-numeric: tabular-nums;
+	}
+
+	.detail-pane {
+		display: grid;
+		grid-template-rows: auto auto minmax(0, 1fr);
+		min-width: 0;
+		min-height: 0;
+		background: #fffaf0;
+	}
+
+	.keyring-toolbar {
+		display: flex;
+		gap: var(--space-1);
+		align-items: center;
+		min-height: 2.35rem;
+		padding: var(--space-1) var(--space-2);
+		background: linear-gradient(#f7ead5, #cfb48f);
+		border-bottom: 1px solid #9a7b57;
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.62) inset;
+	}
+
+	.keyring-toolbar button,
+	.property-row button {
+		display: inline-flex;
+		gap: var(--space-1);
+		align-items: center;
+		min-height: 1.75rem;
+		padding: 0 var(--space-2);
+		color: #2f2218;
+		text-decoration: none;
+		background: linear-gradient(#fff8e8, #d7bd99);
+		border: 1px solid #a1845f;
+		border-radius: var(--radius-1);
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.65) inset;
+		cursor: default;
+		transition-property: filter, scale;
+		transition-duration: 120ms;
+	}
+
+	.keyring-toolbar button:active,
+	.property-row button:active {
+		scale: 0.96;
+	}
+
+	.keyring-toolbar button:disabled {
+		opacity: 0.58;
+	}
+
+	.inspector-message {
+		display: flex;
+		gap: var(--space-2);
+		align-items: center;
+		margin: var(--space-4);
+		padding: var(--space-3);
+		background: #f2e5ca;
+		border: 1px solid #b99a70;
+		border-radius: var(--radius-1);
+	}
+
+	.inspector-message.error {
+		color: #5b160f;
+		background: #f3d5ca;
+		border-color: #b46b55;
+	}
+
+	.identity-heading {
+		display: flex;
+		gap: var(--space-3);
+		align-items: center;
+		min-width: 0;
+		padding: var(--space-3) var(--space-4);
+		background: #f8efdf;
+		border-bottom: 1px solid #d6c2a5;
+	}
+
+	.identity-heading img {
+		width: 3rem;
+		height: 3rem;
+		object-fit: cover;
+		border: 1px solid rgb(68 45 22 / 0.28);
+		border-radius: var(--radius-1);
+	}
+
+	.identity-heading h2 {
+		font-size: var(--text-5);
+		line-height: var(--leading-tight);
+		text-wrap: balance;
+	}
+
+	.identity-heading span {
+		display: block;
+		overflow-wrap: anywhere;
+		font-family: var(--font-mono);
+	}
+
+	.property-section {
+		min-height: 0;
+		padding: var(--space-4);
+		overflow: auto;
+	}
+
+	.property-section h3 {
+		margin-bottom: var(--space-2);
+		font-size: var(--text-3);
+		line-height: var(--leading-tight);
+	}
+
+	.property-section h3:not(:first-child) {
+		margin-top: var(--space-4);
+	}
+
+	.property-grid,
+	.list-box,
+	.validation-list {
+		display: grid;
+		gap: var(--space-2);
+	}
+
+	.property-row,
+	.object-row,
+	.validation-row {
+		background: #fff8ed;
+		border: 1px solid #d0b895;
+		border-radius: var(--radius-1);
+		box-shadow: 0 1px 0 rgb(255 255 255 / 0.72) inset;
+	}
+
+	.property-row {
+		display: grid;
+		grid-template-columns: minmax(7rem, 10rem) minmax(0, 1fr);
+	}
+
+	.property-row dt {
+		padding: var(--space-2);
+		color: #5c442f;
+		background: #ebdbc1;
+		border-right: 1px solid #d0b895;
+		font-weight: 700;
+	}
+
+	.property-row dd {
+		display: grid;
+		grid-template-columns: minmax(0, 1fr) auto;
+		gap: var(--space-2);
+		align-items: center;
+		min-width: 0;
+		padding: var(--space-1) var(--space-2);
+	}
+
+	code,
+	pre {
+		font-family: var(--font-mono);
+		font-size: var(--text-1);
+	}
+
+	code {
+		overflow-wrap: anywhere;
+	}
+
+	.validation-row,
+	.object-row {
+		display: grid;
+		grid-template-columns: 2rem minmax(0, 1fr) auto;
+		gap: var(--space-2);
+		align-items: start;
+		padding: var(--space-2);
+	}
+
+	.object-row {
+		grid-template-columns: 2rem minmax(0, 1fr);
+	}
+
+	.validation-row.valid {
+		border-color: #8ca05f;
+	}
+
+	.validation-row.mismatch {
+		border-color: #b27a4c;
+	}
+
+	.validation-row span {
+		padding: 0.12rem var(--space-2);
+		color: #3d2a1a;
+		background: #ead8b9;
+		border: 1px solid #b89a71;
+		border-radius: 999px;
+		font-size: var(--text-1);
+		font-weight: 700;
+	}
+
+	.raw-section pre {
+		min-height: 20rem;
+		margin: 0;
+		padding: var(--space-3);
+		overflow: auto;
+		color: #28190f;
+		background: #fff8ed;
+		border: 1px solid #c6ad89;
+		border-radius: var(--radius-1);
+		box-shadow: var(--shadow-sunken);
+		white-space: pre-wrap;
+		overflow-wrap: anywhere;
+	}
+
+	.empty-row,
+	.sidebar-empty {
+		padding: var(--space-2);
+	}
+
+	@media (max-width: 700px) {
+		.identity-inspector {
+			grid-template-columns: 1fr;
+			grid-template-rows: auto minmax(0, 1fr);
+		}
+
+		.keyring-sidebar {
+			grid-template-rows: auto auto;
+			border-right: 0;
+			border-bottom: 1px solid #8f704d;
+		}
+
+		.keyring-sidebar nav {
+			grid-auto-flow: column;
+			grid-auto-columns: minmax(10rem, 1fr);
+			overflow-x: auto;
+		}
+
+		.property-row {
+			grid-template-columns: 1fr;
+		}
+
+		.property-row dt {
+			border-right: 0;
+			border-bottom: 1px solid #d0b895;
+		}
+	}
+</style>
diff --git a/src/lib/window-manager.svelte.ts b/src/lib/window-manager.svelte.ts
index 97ddcf5..0ba6c11 100644
--- a/src/lib/window-manager.svelte.ts
+++ b/src/lib/window-manager.svelte.ts
@@ -1,4 +1,6 @@
-export type WindowId = 'main' | 'about-computer' | 'gedit' | 'document-viewer';
+/* Split up this file into windows/types.ts & windows/manager.svelte.ts */
+
+export type WindowId = 'main' | 'about-computer' | 'gedit' | 'document-viewer' | 'identity-inspector';
 
 export type ManagedWindow = {
 	id: WindowId;
@@ -47,10 +49,19 @@ class WindowManager {
 			isMinimized: false,
 			isMaximized: false,
 			zIndex: 4
+		},
+		{
+			id: 'identity-inspector',
+			title: 'Identity Inspector',
+			icon: '/icons/humanity/apps/identity-inspector.svg',
+			isOpen: false,
+			isMinimized: false,
+			isMaximized: false,
+			zIndex: 5
 		}
 	]);
 
-	private nextZIndex = 4;
+	private nextZIndex = 5;
 
 	get openWindows() {
 		return this.windows.filter((window) => window.isOpen);
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 725c55c..5e5e2e3 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -1,3 +1,5 @@
+<!-- FIXME: this is becoming a "god" component, not an orchestrator
+            like it should -->
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { dev } from '$app/environment';
@@ -17,6 +19,7 @@
 	import DocumentViewer from '$lib/components/DocumentViewer.svelte';
 	import Gedit from '$lib/components/Gedit.svelte';
 	import GnomePanel from '$lib/components/GnomePanel.svelte';
+	import IdentityInspector from '$lib/components/IdentityInspector.svelte';
 	import LockScreen from '$lib/components/LockScreen.svelte';
 	import NativeWindow from '$lib/components/NativeWindow.svelte';
 	import NotImplementedDialog from '$lib/components/NotImplementedDialog.svelte';
@@ -53,6 +56,7 @@
 	const aboutWindow = $derived(windowManager.getWindow('about-computer'));
 	const geditWindow = $derived(windowManager.getWindow('gedit'));
 	const documentViewerWindow = $derived(windowManager.getWindow('document-viewer'));
+	const identityInspectorWindow = $derived(windowManager.getWindow('identity-inspector'));
 	const shortcuts = $derived([
 		{
 			label: 'ibex Home',
@@ -72,6 +76,20 @@
 				void goto(resolve('/browse'));
 			}
 		},
+		{
+			label: 'Identity Inspector',
+			icon: '/icons/humanity/apps/identity-inspector.svg',
+			selected: identityInspectorWindow?.isOpen && !identityInspectorWindow.isMinimized,
+			onactivate: () => {
+				if (accountSetup.identity) {
+					void goto(resolve(`/repos/${accountSetup.identity.did}/identity`), { keepFocus: true, noScroll: true });
+					return;
+				}
+
+				windowManager.restore('main');
+				void goto(resolve('/browse'));
+			}
+		},
 		{
 			label: 'Computer',
 			icon: '/icons/humanity/devices/computer.svg',
@@ -115,7 +133,7 @@
 		const route = repoRouteFromParams();
 		if (bootStatus !== 'ready' || !route) return;
 
-		const routeKey = [route.did, route.collection, route.rkey].filter(Boolean).join('/');
+		const routeKey = [route.did, route.app, route.collection, route.rkey].filter(Boolean).join('/');
 		if (handledRepoRoute === routeKey) return;
 
 		handledRepoRoute = routeKey;
@@ -177,7 +195,7 @@
 		accountSetup.load();
 	}
 
-	async function openRepoRoute(route: { did: string; collection?: string; rkey?: string }) {
+	async function openRepoRoute(route: { did: string; app?: string; collection?: string; rkey?: string }) {
 		try {
 			const { hydratePublicIdentity } = await import('$lib/atproto/identity');
 			const identity = await hydratePublicIdentity(route.did);
@@ -185,6 +203,13 @@
 			accountSetup.save(identity);
 			windowManager.restore('main');
 
+			if (route.app === 'identity') {
+				await repoBrowser.load(identity);
+				windowManager.setTitle('identity-inspector', `${identity.handle} - Identity Inspector`);
+				windowManager.open('identity-inspector');
+				return;
+			}
+
 			if (route.collection && route.rkey) {
 				await repoBrowser.openRecordRoute(identity, route.collection, route.rkey);
 				if (repoBrowser.selectedRecord) {
@@ -207,9 +232,9 @@
 		if (!page.route.id?.startsWith('/repos/[did]')) return null;
 
 		const { did, collection, rkey } = page.params;
-		if (!did) return null;
 
-		return { did, collection, rkey };
+		if (!did) return null;
+		return { did, app: page.route.id === '/repos/[did]/identity' ? 'identity' : undefined, collection, rkey };
 	}
 
 	async function waitForMinimumBootTime(startedAt: number) {
@@ -332,6 +357,26 @@
 				</div>
 			{/if}
 
+			{#if identityInspectorWindow?.isOpen && !identityInspectorWindow.isMinimized}
+				<div
+					class="identity-inspector-window"
+					class:maximized={identityInspectorWindow.isMaximized}
+					style:z-index={identityInspectorWindow.zIndex}>
+					<AppWindow
+						windowId="identity-inspector"
+						title={identityInspectorWindow.title}
+						icon="/icons/humanity/apps/identity-inspector.svg"
+						address={accountSetup.identity ? `/repos/${accountSetup.identity.did}/identity` : undefined}
+						maximized={identityInspectorWindow.isMaximized}
+						onfocus={() => windowManager.focus('identity-inspector')}
+						onminimize={() => windowManager.minimize('identity-inspector')}
+						onmaximize={() => windowManager.toggleMaximize('identity-inspector')}
+						onclose={() => windowManager.close('identity-inspector')}>
+						<IdentityInspector />
+					</AppWindow>
+				</div>
+			{/if}
+
 			{#if showStickyNote}
 				<aside class="sticky-note" aria-label="Design note">
 					<button type="button" aria-label="Close note" onclick={() => (showStickyNote = false)}>×</button>
@@ -392,7 +437,8 @@
 	.primary-window.maximized,
 	.about-window.maximized,
 	.document-viewer-window.maximized,
-	.gedit-window.maximized {
+	.gedit-window.maximized,
+	.identity-inspector-window.maximized {
 		position: fixed;
 		top: 1.75rem;
 		right: 0;
@@ -405,7 +451,8 @@
 
 	.about-window,
 	.document-viewer-window,
-	.gedit-window {
+	.gedit-window,
+	.identity-inspector-window {
 		position: absolute;
 		z-index: 3;
 	}
@@ -431,9 +478,17 @@
 		height: min(34rem, calc(100vh - 5rem));
 	}
 
+	.identity-inspector-window {
+		top: min(4.75rem, 9vh);
+		left: min(13rem, 16vw);
+		width: min(56rem, calc(100vw - 2rem));
+		height: min(39rem, calc(100vh - 5rem));
+	}
+
 	.about-window :global(.app-window),
 	.document-viewer-window :global(.app-window),
-	.gedit-window :global(.app-window) {
+	.gedit-window :global(.app-window),
+	.identity-inspector-window :global(.app-window) {
 		height: 100%;
 	}
 
@@ -481,7 +536,8 @@
 		}
 
 		.about-window,
-		.gedit-window {
+		.gedit-window,
+		.identity-inspector-window {
 			left: auto;
 			right: var(--space-3);
 		}
@@ -506,7 +562,8 @@
 		}
 
 		.about-window,
-		.gedit-window {
+		.gedit-window,
+		.identity-inspector-window {
 			top: var(--space-3);
 			right: var(--space-3);
 			left: var(--space-3);
diff --git a/src/routes/repos/[did]/identity/+page.svelte b/src/routes/repos/[did]/identity/+page.svelte
new file mode 100644
index 0000000..60c155b
--- /dev/null
+++ b/src/routes/repos/[did]/identity/+page.svelte
@@ -0,0 +1,4 @@
+<!-- TODO: we should use this page properly, such that identity manager
+    can direct link to it
+-->
+<script lang="ts"></script>