JWT claim policy tester
Test a JSON Web Token against your issuer, audience, expiry and required claim rules at a time you choose. Each rule gets a clear pass or fail so you can see exactly why a token would be refused.
Input is one compact JWT of up to 16384 characters. The evaluation time must fall between 1970-01-01T00:00:00Z and 9999-12-31T23:59:59Z. Clock skew is 0 to 3600 seconds and maximum age up to 315360000 seconds. Decoding and checks run locally in your browser. Download the JSON report with every rule result. Paste one token in the form header.payload.signature. Up to 16,384 characters. Review the settings before running.
Your result
How to use JWT claim policy tester
- Paste the token as header.payload.signature.
- Enter the evaluation time and the allowed clock skew.
- Fill in the accepted issuers, audiences, subject and required claims you want to enforce.
- Run the tool and review each rule in the downloaded report.
Useful next steps
Rules applied
Checks follow RFC 7519 (JSON Web Token, May 2015) section 4.1. A token is expired when the evaluation time is at or after exp plus the skew, not yet valid when the time plus the skew is before nbf, and too old when the time minus iat is more than the maximum age plus the skew. iss must equal one accepted issuer and aud must contain one accepted audience.
Signature not checked
This tool decodes the claims without verifying the signature, so a passing result only means the claims meet your policy. Verify the signature with a trusted key before relying on any claim.
Assumptions and limits
The time is an explicit input, never your device clock. Header and payload JSON with repeated member names is rejected because libraries disagree on which value wins.