happytails.ai

JWT claim policy tester

Open JWT claim policy tester on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "jwt-claim-policy-tester",
  "category": "developer-tools",
  "built": true,
  "requirements": "Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.",
  "implementation": {
    "fields": [
      {
        "key": "time",
        "label": "Evaluation time (UTC or Unix seconds)",
        "value": "2026-10-16T12:00:00Z",
        "type": "text"
      },
      {
        "key": "issuer",
        "label": "Accepted issuers (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "audience",
        "label": "Accepted audiences (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "subject",
        "label": "Expected subject",
        "value": "",
        "type": "text"
      },
      {
        "key": "requiredClaims",
        "label": "Required claims (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "requireExp",
        "label": "Require an exp claim",
        "value": false,
        "type": "checkbox"
      },
      {
        "key": "maxAgeSeconds",
        "label": "Maximum token age in seconds (0 = off)",
        "value": "0",
        "type": "number",
        "min": 0,
        "max": 315360000,
        "step": 1
      },
      {
        "key": "clockSkewSeconds",
        "label": "Allowed clock skew in seconds",
        "value": "60",
        "type": "number",
        "min": 0,
        "max": 3600,
        "step": 1
      }
    ],
    "registrationFamily": "crypto-formats-reference",
    "inputMaxLength": 16384,
    "inputErrorCode": "CRYPTO_FORMATS_REFERENCE_TOO_LONG",
    "note": "Runs in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.",
    "experience": {
      "automatic": false,
      "single": true,
      "inputMaxLength": 16384,
      "inputMode": "text",
      "label": "JSON Web Token",
      "placeholder": "eyJhbGciOi...",
      "help": "Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.",
      "helpParts": [
        "Paste one token in the form header.payload.signature.",
        "Up to 16,384 characters.",
        "Review the settings before running."
      ],
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Test a JSON Web Token against your issuer, audience, expiry and required claim rules at a time you choose. Each rule gets a clear pass or fail so you can see exactly why a token would be refused.

How to use JWT claim policy tester
  1. Paste the token as header.payload.signature.
  2. Enter the evaluation time and the allowed clock skew.
  3. Fill in the accepted issuers, audiences, subject and required claims you want to enforce.
  4. Run the tool and review each rule in the downloaded report.

Useful next steps

Rules applied

Checks follow RFC 7519 (JSON Web Token, May 2015) section 4.1. A token is expired when the evaluation time is at or after exp plus the skew, not yet valid when the time plus the skew is before nbf, and too old when the time minus iat is more than the maximum age plus the skew. iss must equal one accepted issuer and aud must contain one accepted audience.

Signature not checked

This tool decodes the claims without verifying the signature, so a passing result only means the claims meet your policy. Verify the signature with a trusted key before relying on any claim.

Assumptions and limits

The time is an explicit input, never your device clock. Header and payload JSON with repeated member names is rejected because libraries disagree on which value wins.