Email Verification Token Decoder

Decode an SD-JWT email verification token and read every claim, entirely in your browser.

Decode a token

Paste an email verification token (the value a browser puts in the hidden email-verification-token form field). Decoding happens entirely in your browser: nothing is uploaded. To check signatures as well, use the EVP Token Validator.

Anatomy of an EVP token, in thirty seconds

An email verification token is an SD-JWT: components separated by tildes. First comes the issuer JWT, signed by your email provider, carrying the claims that matter: the verified email, an email_verified flag, the audience origin, a nonce and a short expiry. Last comes a key binding JWT, signed by the browser itself with a one-off key pair, which pins the token to this origin and this form so it cannot be lifted and replayed on another site.

Decoding is not verifying. This page shows you what a token says; the validator checks whether the signatures and claims actually hold up.

Frequently Asked Questions

It is an SD-JWT (Selective Disclosure for JWTs): an issuer-signed JWT, then zero or more disclosures, then a key binding JWT, joined by tilde characters. The current EVP profile ships without disclosures, so a typical token is simply issuer JWT, tilde, key binding JWT.

email and email_verified say what was proven. iss names the provider that signed. aud is the origin the token was minted for and must be yours. nonce must match the value your form carried. iat and exp bound the token lifetime, which is short by design. cnf holds the browser ephemeral public key the key binding is checked against.

No. Anyone can base64-decode a JWT; decoding proves nothing about authenticity. Verification means checking the issuer signature against the provider published JWKS, checking the key binding signature against cnf.jwk, and validating the claims. The EVP Token Validator in this lab does all of that.

The decoder runs entirely in your browser and sends nothing to any server. Even so, treat live tokens as credentials: they are short-lived bearer proofs tied to an origin and nonce, and good hygiene is to decode test tokens rather than production ones.

A trailing tilde with nothing after it means no key binding JWT is attached. Issuance responses carry the issuer token in that shape before the browser adds its key binding at form submission time.

EVP Developer Lab

EVP Support Checker

Test whether this browser and provider can run the Email Verification Protocol.

EVP Domain Checker

Look up the _email-verification DNS record and issuer metadata for any email domain.

EVP Token Validator

Validate claims, key binding and the issuer signature on a token.

Was this tool helpful?

Comments

Loading comments...

Check Out Other Popular Tools

Box Shadow Generator

Create beautiful CSS box shadows with our interactive generator. Adjust blur, spread, offsets, and color. Copy CSS code instantly for your web projects.

Design Tools139

Crontab Generator & Explainer

Visual cron schedule editor for creating crontab syntax. Convert human text to cron expressions and vice versa. Includes quick presets.

Developer Tools879

Generate UPC Label

Generate UPC Label online for free. Just enter your 11 or 12 digit code to create, preview, and download your UPC-A barcode instantly.

Developer Tools345