SD-JWT VC Validator
Decode an SD-JWT verifiable credential, expand its disclosures, and verify that each one binds to the signed digests.
Free and informational, and not a qualified validation service under eIDAS. Each mode below states what happens to your input.
What this checks
- Decodes the issuer-signed JWT header and payload.
- Decodes each disclosure and recomputes its base64url SHA-256 digest.
- Confirms every disclosure binds to an
_sdentry or an array-element digest in the signed payload. - Reconstructs the disclosed claim set.
- Optionally verifies the issuer signature against a public JWK you provide.
- Optionally anchors issuer trust against the EU trust framework, via the Tessio verifier service.
Frequently asked
What is an SD-JWT verifiable credential?
SD-JWT VC is a credential format used across the EU Digital Identity Wallet. It is a signed JWT whose claims can be selectively disclosed: the issuer signs digests of salted claims, and the holder reveals only the disclosures they choose. This tool decodes the credential and checks that each disclosure binds to a signed digest.
Does this send my credential anywhere?
Not in local mode. By default the tool runs entirely in your browser and nothing you paste leaves your device. If you tick "anchor issuer trust", the credential is sent to the Tessio verifier service, processed in memory, and not stored.
How is this different from a JWT decoder?
A JWT decoder shows the header and payload. This tool also decodes the disclosures, recomputes their SHA-256 digests, and verifies that each one binds to an _sd entry in the signed payload. Optionally it verifies the issuer signature against a public key you provide.
Does it check whether the issuer is trusted?
Optionally. Tick "anchor issuer trust" to send the credential to the Tessio verifier service, which checks the issuer against the EU trust framework using the same engine that powers Tessio Cloud. Local mode does not check issuer trust.