# JWT claim policy tester

- Human page: https://happytails.ai/en/developer-tools/jwt-claim-policy-tester/
- Markdown: https://happytails.ai/en/developer-tools/jwt-claim-policy-tester.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/jwt-claim-policy-tester/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `jwt-claim-policy-tester` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Runs in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.

### Inputs and settings

Text input: JSON Web Token.

Example or placeholder shown in the interface (not a validated fixture):

```text
eyJhbGciOi...
```

Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `time` | Evaluation time (UTC or Unix seconds) | text | "2026-10-16T12:00:00Z" |  |
| `issuer` | Accepted issuers (comma separated) | text | "" |  |
| `audience` | Accepted audiences (comma separated) | text | "" |  |
| `subject` | Expected subject | text | "" |  |
| `requiredClaims` | Required claims (comma separated) | text | "" |  |
| `requireExp` | Require an exp claim | checkbox | false |  |
| `maxAgeSeconds` | Maximum token age in seconds (0 = off) | number | "0" | min=0 max=315360000 step=1 |
| `clockSkewSeconds` | Allowed clock skew in seconds | number | "60" | min=0 max=3600 step=1 |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "jwt-claim-policy-tester",
  "category": "developer-tools",
  "built": true,
  "requirements": "Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result.",
  "implementation": {
    "fields": [
      {
        "key": "time",
        "label": "Evaluation time (UTC or Unix seconds)",
        "value": "2026-10-16T12:00:00Z",
        "type": "text"
      },
      {
        "key": "issuer",
        "label": "Accepted issuers (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "audience",
        "label": "Accepted audiences (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "subject",
        "label": "Expected subject",
        "value": "",
        "type": "text"
      },
      {
        "key": "requiredClaims",
        "label": "Required claims (comma separated)",
        "value": "",
        "type": "text"
      },
      {
        "key": "requireExp",
        "label": "Require an exp claim",
        "value": false,
        "type": "checkbox"
      },
      {
        "key": "maxAgeSeconds",
        "label": "Maximum token age in seconds (0 = off)",
        "value": "0",
        "type": "number",
        "min": 0,
        "max": 315360000,
        "step": 1
      },
      {
        "key": "clockSkewSeconds",
        "label": "Allowed clock skew in seconds",
        "value": "60",
        "type": "number",
        "min": 0,
        "max": 3600,
        "step": 1
      }
    ],
    "registrationFamily": "crypto-formats-reference",
    "inputMaxLength": 16384,
    "inputErrorCode": "CRYPTO_FORMATS_REFERENCE_TOO_LONG",
    "note": "Runs in your browser. Claims are checked against your policy at the time you enter; the signature is not verified.",
    "experience": {
      "automatic": false,
      "single": true,
      "inputMaxLength": 16384,
      "inputMode": "text",
      "label": "JSON Web Token",
      "placeholder": "eyJhbGciOi...",
      "help": "Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Test a JSON Web Token against your issuer, audience, expiry and required claim rules at a time you choose. Each rule gets a clear pass or fail so you can see exactly why a token would be refused.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use JWT claim policy tester

1. Paste the token as header.payload.signature.
2. Enter the evaluation time and the allowed clock skew.
3. Fill in the accepted issuers, audiences, subject and required claims you want to enforce.
4. Run the tool and review each rule in the downloaded report.

## Useful next steps

- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))

- [HMAC generator](https://happytails.ai/en/developer-tools/hmac-generator/) ([Markdown](https://happytails.ai/en/developer-tools/hmac-generator.md))

- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))

## Rules applied

Checks follow RFC 7519 (JSON Web Token, May 2015) section 4.1. A token is expired when the evaluation time is at or after exp plus the skew, not yet valid when the time plus the skew is before nbf, and too old when the time minus iat is more than the maximum age plus the skew. iss must equal one accepted issuer and aud must contain one accepted audience.

### Signature not checked

This tool decodes the claims without verifying the signature, so a passing result only means the claims meet your policy. Verify the signature with a trusted key before relying on any claim.

### Assumptions and limits

The time is an explicit input, never your device clock. Header and payload JSON with repeated member names is rejected because libraries disagree on which value wins.