v150 · Origin Trial · Identity

Server Validator

When the browser delivers an EVP token to your site, your server must verify it before trusting the email address. This tool walks through every required check — cryptographic signature, issuer, audience, expiry, nonce replay, and the email_verified flag — against any base64url-encoded JWT you paste in.

Origin trial feature. EVP tokens are only issued by participating mail providers through Chrome 150's origin trial. The built-in sample below is signed by this demo server with WebCrypto, and validation calls the backend so the cryptographic signature check is real.

EVP token (JWT)

Also configure the expected values:

Expected audience (aud)

Nonce (from session)

Required JWT claims for EVP

iss (issuer)

Must match the mail provider's known issuer URL. Check against your allowlist of participating EVP providers.

aud (audience)

Must exactly match your site's origin. Prevents tokens issued to one site being replayed on another.

exp (expiry)

Unix timestamp. Reject tokens where exp < Date.now()/1000. Short-lived tokens (minutes) are normal.

nonce

Must match the nonce your server generated for this session. Prevents replay attacks. Mark used after first verification.

email

The email address the provider is vouching for. This is the address you associate with the new account.

email_verified

Boolean. Must be true. Some providers may issue tokens with false if verification is incomplete — reject those.

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗