NVIDIA attestation token decoder: read an NRAS JWT in the browser

Free tool by VoltageGPU. Paste an NVIDIA Remote Attestation Service (NRAS) token, a JSON Web Token, or drop a voltage-verify bundle.json. The page decodes the header (alg ES384, kid) and the claims (iss, iat, exp, eat_nonce, measres, secboot, dbgstat, hwmodel, ueid, submods, x-nvidia-overall-att-result, the x-nvidia-gpu-attestation-report claims, x-nvidia-gpu-driver-version, x-nvidia-gpu-vbios-version and the RIM claims), explains the claims our pages document, marks values that differ from the policy voltage-verify applies, and tells whether the token has expired by the browser's clock. Decoding runs in the browser and nothing is uploaded. The page decodes and does not verify the ES384 signature: voltage-verify does.

Free tool · runs in your browser

NVIDIA attestation token decoder

Q: Why does it say the token has expired?

An NRAS token expires an hour after iat, and the page compares exp with your browser's clock. For archived evidence that is expected: an archived token is judged at its own iat, since this is evidence, not a session.

Paste an NVIDIA Remote Attestation Service (NRAS) token, a JWT, or drop a voltage-verify bundle.json. You get the header and the claims, with what our pages say about each one, and whether the token has expired by your browser's clock.

Local Decoded in your browser: what you paste or drop is never uploaded.
Decoded, not verified No signature, key or certificate chain is checked here.

Input

JWT · nvidia.nras · bundle.json

NVIDIA NRAS token (a JWT), the nvidia.nras array, or a whole bundle.json

Open a file

Or drop a file on this box. The example is the GPU-0 token of our bundle from the RTX PRO 6000 Blackwell VM, 17 September 2026; drop the whole bundle.json to see its three tokens.

This page decodes. It does not verify.

A token edited by hand decodes just as well: in our FAQ, setting dbgstat to enabled in the payload is rejected by the signature check. Verifying means taking the signing key from NRAS's JWKS through its x5c certificate chain, checking the ES384 signature, then eat_nonce and the claims. voltage-verify does it for the tokens of a bundle:

pip install "voltage-verify>=0.2.3"
voltage-verify verify bundle.json --challenge <yours>

voltage-verify: what it checks, its source (MIT) and its published files. For one token on its own, the check by hand fits in one Python file: How do I verify an NVIDIA GPU attestation token myself?

The claims our pages document

The decoder shows these notes next to each claim. Every other claim is shown as decoded: see NVIDIA's claims guide.

alg (header): NVIDIA signs NRAS tokens with ES384 (ECDSA on P-384 with SHA-384), with a 96-byte signature. The SDK's own overall token is HS256 and proves nothing about NVIDIA.
kid (header): The signing key's id in NRAS's JWKS, of the form nv-eat-kid-prod-…. Take that key through its x5c certificate chain: anyone can publish bare JWK coordinates.
eat_nonce: The nonce NRAS signed over. A policy checks that it is the nonce you chose; in a voltage-verify bundle it is the SHA-256 of the manifest that holds your challenge.
measres: Per NVIDIA's claims guide, the runtime measurements match the Reference Integrity Measurements (RIM). A policy requires success.
secboot: Secure boot. A policy requires true.
dbgstat: “Indicates if GPU debug facilities are enabled or disabled” (NVIDIA's claims guide). A policy requires disabled.
x-nvidia-gpu-attestation-report-nonce-match: Nonce matched. A policy requires true.
x-nvidia-gpu-attestation-report-signature-verified: Report signature verified. A policy requires true.
x-nvidia-gpu-attestation-report-cert-chain-validated: A valid chain in NVIDIA's PKI, not expired, not revoked. A policy requires true.
x-nvidia-overall-att-result: The verifier token's overall result. A policy requires true.
hwmodel: The GPU model the token names. A policy checks it against the model you expect: asked for GH100, voltage-verify fails on a GB20X token.
ueid: Identifies the GPU: a verified token speaks for the GPU with that ueid.
submods: Names each GPU token by the SHA-256 digest of the token: every device token must be the one the verifier token names.
x-nvidia-gpu-driver-version: The driver version the token reports.
x-nvidia-gpu-vbios-version: The VBIOS version the token reports.
iss: Who issued the token: https://nras.attestation.nvidia.com for NVIDIA's tokens. The SDK's own token says NV-Attestation-SDK, which is not NVIDIA's signature.
iat: When NRAS issued the token. NRAS signing certificates live about two days, so an archived token is judged at its own iat; voltage-verify also wants the verifier token's iat within 15 minutes of the bundle's creation.
exp: The token expires an hour after iat. The checker behind our /verify/share page does not enforce it: this is evidence, not a session.
x-nvidia-gpu-driver-rim-*, x-nvidia-gpu-vbios-rim-*: One of the ten RIM claims for the driver and the VBIOS (RIM: Reference Integrity Measurements).

Where the notes come from

From our FAQ on verifying an NVIDIA GPU attestation token, the checker behind our bundle check page and the voltage-verify documentation, nothing else. The example is the GPU-0 token of our bundle from the RTX PRO 6000 Blackwell VM, 17 September 2026 (README).

The CPU half of a bundle is an Intel TDX quote: read it with the Intel TDX quote decoder.

Questions

Does this page verify the token?

No. It decodes the header and the claims and checks nothing: a token edited by hand decodes just as well, while in our FAQ one character changed in the payload (dbgstat set to enabled) is rejected by the signature check. voltage-verify checks the tokens of a bundle: pip install "voltage-verify>=0.2.3", then voltage-verify verify bundle.json --challenge <yours>.

Is my token sent anywhere?

No. Decoding runs in your browser and what you paste or drop is never uploaded. The only download is the example button's: our public bundle of 17 September 2026.

Why does it say the token has expired?

An NRAS token expires an hour after iat, and the page compares exp with your browser's clock. For archived evidence that is expected: an archived token is judged at its own iat, since this is evidence, not a session.

What is the HS256 token at the top of a bundle?

The nv-attestation-sdk signs that one itself, with a local secret (issuer NV-Attestation-SDK): nobody outside the VM can verify it and it proves nothing. NVIDIA's tokens sit under REMOTE_GPU_CLAIMS: one verifier token and one token per GPU, signed with ES384.