Tools

All tools

• SD-JWT decoder

  Decode SD-JWT and SD-JWT VC locally: header, claims, disclosures with digest matching and the key binding JWT, without the token leaving the browser.

• JWS and JWT decoder

  Decode JWT and JWS locally: header, payload, times and signature length, without the token going to a server. For decisions, receipts and status lists.

• RFC 9421 signature base

  Build the RFC 9421 signature base from a signed HTTP request and compare it with your own implementation, locally in the browser, with the IETF example.

• Status list decoder

  Decode an IETF Token Status List locally: bits per entry, number of entries, revoked entries and the status at a given index.

• Timestamp inspector (RFC 3161)

  Read an RFC 3161 timestamp locally: time, hash algorithm, hash of the data, serial number, timestamp authority and embedded certificates.

Decoding is not verifying

A decoder makes visible what a token contains: header, claims, disclosures, times. It says nothing about whether the signature holds, whether the issuer is trustworthy or whether a mandate was revoked. Every output of the tools is therefore explicitly marked “decoded, not verified”.

For a reliable result, there is the verification page. It checks the same evidence in ten steps and returns a verdict with a level.

Why local

Many online decoders send tokens to a server. Evidence from agents can contain names, amounts or identifiers of principals. KYA's tools compute exclusively in the browser; the page's content security policy forbids network requests from the tool.

Frequently asked questions

Do the tools cost anything?

No. All tools are free, need no account and run entirely in the browser.

Are my tokens transmitted?

No. The tools make no network requests; the page's content security policy does not allow it.

How do they differ from the verification page?

The tools show what evidence contains. The verification page checks whether it holds: signatures, issuer, validity, scope, revocation and time.