A SPIFFE decoder reads an X.509-SVID, the short-lived certificate a workload uses to prove its identity, and extracts the SPIFFE ID (spiffe://trust-domain/path) from it.
Example
An X.509-SVID decodes to its SPIFFE identity and trust domain:
SPIFFE ID: spiffe://prod.example.com/ns/payments/sa/api
Trust domain: prod.example.com
SVID type: leaf (workload SVID)
Key: Ed25519The SPIFFE ID is the single URI in the certificate's Subject Alternative Name extension.
What is SPIFFE?
SPIFFE (Secure Production Identity Framework for Everyone) is a CNCF standard for giving every workload, such as a pod, VM or process, a cryptographic identity that doesn't depend on network location. The identity is a URI:
spiffe://prod.example.com/ns/payments/sa/apiThe part after spiffe:// is the trust domain, and the path identifies the workload. Identities are issued as SVIDs (SPIFFE Verifiable Identity Documents), either as X.509 certificates or as JWTs. SPIRE is the reference implementation, and service meshes such as Istio and Linkerd use the same model for mutual TLS.
In an X.509-SVID, the SPIFFE ID is the one and only URI in the Subject Alternative Name extension. The certificate is usually valid for an hour or less and is rotated automatically.
How to use the SPIFFE decoder
- Paste the workload's
-----BEGIN CERTIFICATE-----block, or open the SVID file. - Read the SPIFFE ID, trust domain and whether it's a leaf (workload) or signing certificate.
- Check the validity window — SVIDs are short-lived and rotate automatically.
You can also read the URI SAN with openssl:
openssl x509 -in svid.pem -noout -ext subjectAltName -dates
# X509v3 Subject Alternative Name:
# URI:spiffe://prod.example.com/ns/payments/sa/apiX.509-SVID rules
| Rule | Requirement |
|---|---|
| SPIFFE ID location | Exactly one URI SAN |
| Leaf certificate | CA:FALSE, with digitalSignature key usage |
| Signing certificate | CA:TRUE, URI SAN optional |
| Lifetime | Short, typically under 1 hour, rotated automatically |
Frequently asked questions
What is a trust domain?
The root of trust for a set of identities, usually one per environment or organization. Workloads only trust SVIDs signed by the bundle of their own trust domain or of federated domains.
Is a SPIFFE ID a secret?
No. It's an identifier, like a username. The private key that goes with the SVID is the secret.
Can SVIDs be JWTs?
Yes. JWT-SVIDs carry the SPIFFE ID in the sub claim and are used where mutual TLS isn't possible. Decode one with the JWT decoder.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown