Authentication
JWT Claim Test Matrix Generator
Model issuer, audience, required claims, time tolerance, scope, expiration, and not-before expectations without creating signed production tokens.
How this tool works
JWT validation combines cryptographic verification with claim policy. A correctly signed token can still be unacceptable because its issuer, audience, time window, required claims, or scope do not match the resource server.
The matrix normalizes comma-separated required claim names, includes each in the valid synthetic object, and creates one coherent missing case per required claim alongside expired, near-boundary, future not-before, issuer, audience, malformed NumericDate, scope, and ambiguous-shape cases.
Examples
- Test expiration just outside allowed skew.
- Exercise an audience array containing the expected audience.
- Separate missing exp policy from signature behavior.
Common use cases
Cryptographic boundary
A claim matrix cannot prove that a library rejects algorithm confusion, selects the correct key, validates a certificate chain, handles key rotation, or resists token substitution. Run those tests against the actual verifier with controlled keys and synthetic identities.
Policy questions
- Which issuer strings are exact matches?
- Can aud be a string or array?
- Is exp mandatory?
- How much clock skew is allowed?
- Are scopes space-delimited, arrays, or another claim?
- Which claims are required independently of signature validity?
Failure case: JWT Claim Tests
Invalid/failure example
Separate missing exp policy from signature behavior.
Expected: The matrix normalizes comma-separated required claim names, includes each in the valid synthetic object, and creates one coherent missing case per required claim alongside expired, near-boundary, future not-before, issuer, audience, malformed NumericDate, scope, and ambiguous-shape cases.
Related guides
Official references
FAQ
Does this tool send the pasted data or execute an API request?
No. Analysis runs in this browser tab. The tool does not call pasted URLs, resolve remote references, or submit the input to a DevPouch processing endpoint.
Does the matrix verify a JWT signature?
No. It generates claim-level test descriptions and synthetic JSON only. Cryptographic algorithm selection, key trust, signature verification, and key rotation need dedicated tests.
What is clock skew?
A verifier may allow a small configured time tolerance around time-based claims. The exact allowance is policy, not a value the generator assumes.