Google Wallet link decoder
Paste an “Add to Google Wallet” link to see what's in its JWT, the classes and objects it saves, and whether they follow Google's reference.
Your link stays in your browser
- Read on your deviceThis page decodes it on your computer or phone. It isn't opened, and the pass's images aren't loaded.
- Never sent to our serverNothing is uploaded to WalletPassAPI, or to anyone else.
- No copy keptIt's gone when you close the page. Anything you save goes straight to your device.
The JWT
- ID
- Class
- State
- Barcode
- Colour
Only its ID and class: the object's details are already at Google, so they aren't in the link.
Decoded
What it checks
Everything comes from Google's documentation: the JWT reference, Issuing passes for web, email and SMS, Working with JSON Web Tokens and the class and object reference.
The link
- It's https://pay.google.com/gp/v/save/ and a JWT
- The JWT is within the 1800 characters Google gives as safe
- It's signed, and with which algorithm and key
The claims
- iss is a service account's email address
- aud is “google” and typ is “savetowallet”
- iat is the issue time, in seconds
- origins lists the websites that may show the button
Classes and objects
- The payload uses the keys in Google's JWT reference
- Every ID is issuerID.identifier, with allowed characters, and one issuer throughout
- Each object has a class, in the link or already at Google
- Generic passes have a card title and header; loyalty classes a program name, issuer name and review status
- States, barcode types and background colours use Google's values
Got an Apple Wallet pass to check too? Open it in the .pkpass inspector.
Or let WalletPassAPI make the links
One request makes a pass for Google Wallet and Apple Wallet: we build the class and object, sign the link with your issuer's service account, and give each pass an install page.
Questions
What's in an Add to Google Wallet link?
https://pay.google.com/gp/v/save/ followed by a signed JWT. The JWT names your Google Cloud service account (iss), says it's for Google Wallet (aud “google”, typ “savetowallet”), when it was issued (iat), which websites may show the button (origins), and a payload of the classes and objects, the passes, to save.
Why doesn't my Add to Google Wallet link work?
Check what Google requires: aud “google” and typ “savetowallet”; IDs in the form issuerID.identifier, using only letters, digits, “.”, “_” and “-”; the fields each class and object requires; and a JWT signed with the key of the service account you authorized in the Google Wallet Business Console. Google gives 1800 characters as the safe length for the JWT: longer, and browsers may cut the link short.
Why does my pass say [TEST ONLY]?
Your issuer is still in demo mode. Google adds “[TEST ONLY]” to the title of every pass until you're granted publishing access; after that, it goes when the holder next opens the wallet app.
Does it check the signature?
No. Checking it needs Google's public keys for your service account, and Google checks it anyway when the link is opened. The decoder shows which algorithm and key signed it, and everything inside.
Is my link sent anywhere?
No. The link is decoded in your browser and nothing is sent to us or to Google. That matters because a link can carry a pass holder's name and member number. The pass's image addresses are shown as text, never loaded.