{
  "title": "JWT claim policy tester",
  "human_url": "https://happytails.ai/en/developer-tools/jwt-claim-policy-tester/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/jwt-claim-policy-tester/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/jwt-claim-policy-tester.md",
  "content": "JWT claim policy tester\nTest a JSON Web Token against your issuer, audience, expiry and required claim rules at a time you choose. Each rule gets a clear pass or fail so you can see exactly why a token would be refused.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use JWT claim policy tester\nPaste the token as header.payload.signature.\nEnter the evaluation time and the allowed clock skew.\nFill in the accepted issuers, audiences, subject and required claims you want to enforce.\nRun the tool and review each rule in the downloaded report.\nUseful next steps\nJWT decoder\nHMAC generator\nBase64 encoder decoder\nRules applied\nChecks follow RFC 7519 (JSON Web Token, May 2015) section 4.1. A token is expired when the evaluation time is at or after exp plus the skew, not yet valid when the time plus the skew is before nbf, and too old when the time minus iat is more than the maximum age plus the skew. iss must equal one accepted issuer and aud must contain one accepted audience.\nSignature not checked\nThis tool decodes the claims without verifying the signature, so a passing result only means the claims meet your policy. Verify the signature with a trusted key before relying on any claim.\nAssumptions and limits\nThe time is an explicit input, never your device clock. Header and payload JSON with repeated member names is rejected because libraries disagree on which value wins.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "JWT decoder",
      "url": "https://happytails.ai/en/developer-tools/jwt-decoder/"
    },
    {
      "name": "HMAC generator",
      "url": "https://happytails.ai/en/developer-tools/hmac-generator/"
    },
    {
      "name": "Base64 encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/base64-encoder-decoder/"
    }
  ],
  "tool": {
    "id": "jwt-claim-policy-tester",
    "category": "developer-tools",
    "built": true,
    "requirements": "Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.",
    "implementation": {
      "fields": [
        {
          "key": "time",
          "label": "Evaluation time (UTC or Unix seconds)",
          "value": "2026-10-16T12:00:00Z",
          "type": "text"
        },
        {
          "key": "issuer",
          "label": "Accepted issuers (comma separated)",
          "value": "",
          "type": "text"
        },
        {
          "key": "audience",
          "label": "Accepted audiences (comma separated)",
          "value": "",
          "type": "text"
        },
        {
          "key": "subject",
          "label": "Expected subject",
          "value": "",
          "type": "text"
        },
        {
          "key": "requiredClaims",
          "label": "Required claims (comma separated)",
          "value": "",
          "type": "text"
        },
        {
          "key": "requireExp",
          "label": "Require an exp claim",
          "value": false,
          "type": "checkbox"
        },
        {
          "key": "maxAgeSeconds",
          "label": "Maximum token age in seconds (0 = off)",
          "value": "0",
          "type": "number",
          "min": 0,
          "max": 315360000,
          "step": 1
        },
        {
          "key": "clockSkewSeconds",
          "label": "Allowed clock skew in seconds",
          "value": "60",
          "type": "number",
          "min": 0,
          "max": 3600,
          "step": 1
        }
      ],
      "registrationFamily": "crypto-formats-reference",
      "inputMaxLength": 16384,
      "inputErrorCode": "CRYPTO_FORMATS_REFERENCE_TOO_LONG",
      "note": "Runs in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.",
      "experience": {
        "automatic": false,
        "single": true,
        "inputMaxLength": 16384,
        "inputMode": "text",
        "label": "JSON Web Token",
        "placeholder": "eyJhbGciOi...",
        "help": "Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# JWT claim policy tester\n\n- Human page: https://happytails.ai/en/developer-tools/jwt-claim-policy-tester/\n- Markdown: https://happytails.ai/en/developer-tools/jwt-claim-policy-tester.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/jwt-claim-policy-tester/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `jwt-claim-policy-tester` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nRuns in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.\n\n### Inputs and settings\n\nText input: JSON Web Token.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\neyJhbGciOi...\n```\n\nPaste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `time` | Evaluation time (UTC or Unix seconds) | text | \"2026-10-16T12:00:00Z\" |  |\n| `issuer` | Accepted issuers (comma separated) | text | \"\" |  |\n| `audience` | Accepted audiences (comma separated) | text | \"\" |  |\n| `subject` | Expected subject | text | \"\" |  |\n| `requiredClaims` | Required claims (comma separated) | text | \"\" |  |\n| `requireExp` | Require an exp claim | checkbox | false |  |\n| `maxAgeSeconds` | Maximum token age in seconds (0 = off) | number | \"0\" | min=0 max=315360000 step=1 |\n| `clockSkewSeconds` | Allowed clock skew in seconds | number | \"60\" | min=0 max=3600 step=1 |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nInput is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"jwt-claim-policy-tester\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"time\",\n        \"label\": \"Evaluation time (UTC or Unix seconds)\",\n        \"value\": \"2026-10-16T12:00:00Z\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"issuer\",\n        \"label\": \"Accepted issuers (comma separated)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"audience\",\n        \"label\": \"Accepted audiences (comma separated)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"subject\",\n        \"label\": \"Expected subject\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"requiredClaims\",\n        \"label\": \"Required claims (comma separated)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"requireExp\",\n        \"label\": \"Require an exp claim\",\n        \"value\": false,\n        \"type\": \"checkbox\"\n      },\n      {\n        \"key\": \"maxAgeSeconds\",\n        \"label\": \"Maximum token age in seconds (0 = off)\",\n        \"value\": \"0\",\n        \"type\": \"number\",\n        \"min\": 0,\n        \"max\": 315360000,\n        \"step\": 1\n      },\n      {\n        \"key\": \"clockSkewSeconds\",\n        \"label\": \"Allowed clock skew in seconds\",\n        \"value\": \"60\",\n        \"type\": \"number\",\n        \"min\": 0,\n        \"max\": 3600,\n        \"step\": 1\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-reference\",\n    \"inputMaxLength\": 16384,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_REFERENCE_TOO_LONG\",\n    \"note\": \"Runs in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": true,\n      \"inputMaxLength\": 16384,\n      \"inputMode\": \"text\",\n      \"label\": \"JSON Web Token\",\n      \"placeholder\": \"eyJhbGciOi...\",\n      \"help\": \"Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nTest a JSON Web Token against your issuer, audience, expiry and required claim rules at a time you choose. Each rule gets a clear pass or fail so you can see exactly why a token would be refused.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use JWT claim policy tester\n\n1. Paste the token as header.payload.signature.\n2. Enter the evaluation time and the allowed clock skew.\n3. Fill in the accepted issuers, audiences, subject and required claims you want to enforce.\n4. Run the tool and review each rule in the downloaded report.\n\n## Useful next steps\n\n- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))\n\n- [HMAC generator](https://happytails.ai/en/developer-tools/hmac-generator/) ([Markdown](https://happytails.ai/en/developer-tools/hmac-generator.md))\n\n- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))\n\n## Rules applied\n\nChecks follow RFC 7519 (JSON Web Token, May 2015) section 4.1. A token is expired when the evaluation time is at or after exp plus the skew, not yet valid when the time plus the skew is before nbf, and too old when the time minus iat is more than the maximum age plus the skew. iss must equal one accepted issuer and aud must contain one accepted audience.\n\n### Signature not checked\n\nThis tool decodes the claims without verifying the signature, so a passing result only means the claims meet your policy. Verify the signature with a trusted key before relying on any claim.\n\n### Assumptions and limits\n\nThe time is an explicit input, never your device clock. Header and payload JSON with repeated member names is rejected because libraries disagree on which value wins.\n"
}