Guide

Check a token

Find out who a token is for, when it expires and whether anything about it looks wrong.

1. Copy a JWT or JWE and press ⌘V in Tessera. You can also drop a .jwt or .jwe file on the window, or open one with ⌘O.
2. Read the verdict at the top: Verified, Invalid signature, Unsigned or Key needed, with a live countdown to expiry.
3. Look at Security checks for plain-English warnings, such as alg: none, an expired token, a missing audience, a weak HMAC secret, or a key URL in the header.
4. Switch between the claims list and the raw JSON with ⌘1 and ⌘2. Show or hide the inspector with ⌥⌘I.

Verify a signature with a key

Check that a token was signed by the key you expect.

1. Open the token, then paste the key into the inspector's key field: a shared secret, a PEM public key or certificate, a JWK, or a whole JWKS.
2. With a JWKS, Tessera picks the key whose kid matches the token's header.
3. If the token carries its own certificate chain (x5c), choose Verify with Embedded Certificate. To check the chain against a root you trust, paste that root's PEM certificate into Trusted root.

Tessera only accepts a key that matches the token's algorithm, which protects against algorithm-confusion attacks.

Fetch keys from the issuerPro

Verify a token from an OpenID Connect provider without hunting for its public keys.

1. Open the token and choose Fetch keys from issuer in the inspector.
2. Tessera reads the token's iss, finds the issuer's key set through OpenID Connect discovery, and verifies with the key that matches kid.
3. Keys are cached for up to 24 hours. Choose Refresh to fetch them again, for example after the issuer rotates keys.

Tessera downloads the issuer's public keys straight from the issuer over HTTPS. Nothing from your token is sent.

Decrypt a JWE

Read an encrypted token and the token nested inside it.

1. Paste the JWE. Tessera shows its protected header straight away, including which algorithm and which key it needs.
2. Paste the matching key into the inspector: an RSA or EC private key, a symmetric key, or the password for PBES2.
3. If the decrypted payload is itself a signed token, Tessera shows it inline. Open it as the current token to verify it with its own key.

Build and sign a token

Make a test token for a local API or an integration test.

1. Switch to Encode with ⇧⌘E. Use ⇧⌘D to get back to decoding.
2. Edit the header and claims as a form or as JSON. Quick adds fill in exp, iat, nbf and jti.
3. Pick a signing algorithm and paste a secret or private key, or fill in a random secret of the right length. Copy the token when you're done.
4. With Tessera Pro, start from an OAuth access token, ID token or service token template, sign with a saved key, or turn on Encrypt as JWE.

Save keys in your KeychainPro

Keep the keys you use every day one click away, and locked when you're not using them.

1. After pasting a key into the inspector, choose Save key to library and give it a name. You can also add keys in Settings › Keys.
2. Turn on Require Touch ID or password for any key you want to keep behind Touch ID.
3. Next time, choose the saved key in the inspector instead of pasting it.

Saved keys stay in the Keychain on this Mac and are never synced or uploaded.

Peek at tokens from the menu barPro

See who a copied token is for and when it expires, without switching apps.

1. In Settings › General, turn on Show menu bar item. Turn on Global shortcut to open it from any app with ⌃⌥⌘J, or record a shortcut of your own.
2. In Settings › Privacy, turn on Watch the clipboard for tokens. Tessera then notices tokens as you copy them.
3. Click the menu bar item to see the token's subject, issuer, expiry and verdict, then Copy payload or Open in Tessera.

Clipboard watch is off until you turn it on. It only reads plain text, and keeps nothing unless it's a token.

Activate a license from this website

For Tessera Pro bought on this site rather than the Mac App Store.

1. Copy the license key from your purchase email. It starts with TSR1-.
2. In Tessera, open Settings › Purchases, choose Enter License…, paste the key and choose Activate.
3. Moving to a new Mac? Activate the same key there. To remove it from an old Mac, choose Deactivate on This Mac….
4. Lost the email? Find my license sends it again.