--- title: "SD-JWT decoder: read disclosures and key binding" url: https://knowyouragent.ch/en/tools/sd-jwt-decoder lang: en updated: 2026-10-12 license: © Innopulse Consulting GmbH --- # SD-JWT decoder Paste an SD-JWT and see the header, claims, all disclosures with their digest and the key binding JWT. The token does not leave the browser. InputDecodeLoad exampleClear ## How it works An SD-JWT consists of a signed JWT, several disclosures and optionally a [key binding](https://knowyouragent.ch/en/knowledge/glossary/key-binding) JWT, separated by tildes (~). The decoder splits the parts, reads the header and claims of the JWT and decodes each disclosure. For every disclosure, it computes the digest with the algorithm stated in the token, usually SHA-256, and looks for it in the signed part. ## What the decoder shows - The header with algorithm, type and key ID. - The claims of the signed part, with times such as iat and exp in readable form. - Each disclosure with name, value, digest and whether its digest is referenced in the token. - The number of hidden details contained only as digests. - The [key binding JWT](https://knowyouragent.ch/en/knowledge/glossary/key-binding), if present. ## What the decoder does not do It verifies neither the issuer's signature nor that of the key binding JWT, and it assesses no key. A disclosure whose digest is referenced is not thereby genuine. For these questions, there is the [verification page](https://knowyouragent.ch/en/verify); the term [selective disclosure](https://knowyouragent.ch/en/knowledge/glossary/selective-disclosure) explains the background. ## Typical uses - **Development:** check whether your own software creates disclosures correctly and references them in the signed part. - **Troubleshooting:** a verification reports a digest error; the decoder shows which disclosure does not match. - **Data protection:** see which details an agent actually discloses and which stay hidden. ## Troubleshooting tips When copying, make sure no line breaks or spaces get into the token. If an SD-JWT ends without a key binding JWT, a single tilde stands at the end. If a digest does not match, the disclosure was usually re-encoded instead of taken over character for character. ## Frequently asked questions ### What does “referenced in the token” mean? The disclosure's digest appears in the signed part, for example in an _sd field. If it is missing, the disclosure does not belong to this token and would be flagged in a verification. ### What are hidden details? Digests in the signed part for which no disclosure was provided. The holder did not disclose these details; their content remains invisible. ### Does the decoder support Verifiable Intent? Yes, as far as reading goes: the layers of Verifiable Intent are SD-JWT. To check the bindings between the layers, use the verification page. ### Which hash algorithms does the decoder understand? SHA-256, SHA-384 and SHA-512, depending on _sd_alg. If the claim is missing, SD-JWT defaults to SHA-256. ### Can I paste an SD-JWT without disclosures? Yes. The decoder then shows the signed part and the number of hidden details; the disclosures table stays empty. This shows how many details a credential contains without revealing them. --- Quelle: https://knowyouragent.ch/en/tools/sd-jwt-decoder · KYA – Know Your Agent