JWT Claims Validator

Check issuer, audience, time, nonce, and profile claims separately from cryptographic signature verification.

Claim policy is not signature verification, authorization, or proof that an issuer controls a URL.

JWTThree-part compact token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLnRlc3QiLCJzdWIiOiJ1c2VyLTEwMCIsImF1ZCI6ImNsaWVudC0xMDAiLCJleHAiOjQxMDAwMDAwMDAsImlhdCI6MTc2NDAwMDAwMCwibm9uY2UiOiJub25jZS0xMDAifQ.demo

Expected claimsJSON policy · not a key

{
  "profile": "oidc-id-token",
  "issuer": "https://issuer.example.test",
  "audience": "client-100",
  "nonce": "nonce-100",
  "clockSkewSeconds": 60,
  "now": 1764000100
}

StatusReviewable

Signaturenot_checked

Claims6

Claim reviewSignature intentionally not checked

{
  "signature": "not_checked",
  "claimPolicy": "pass",
  "issues": []
}