Stop Pasting Production JWTs into Random Websites: The Security Guide to JSON Web Tokens
How many times this week have you opened a random online "JWT Debugger", pasted an Authorization: Bearer eyJhbGci... token from your production network tab, and hit enter? Most developers treat online JWT inspectors like formatters. But here is the uncomfortable truth: when you paste a token into a server-rendered online decoder, you are handing a third-party server your user IDs, tenant claims,…
Many developers copy and paste production JSON Web Tokens (JWTs) into random online debuggers and inspect them. This is a dangerous practice as it exposes user IDs, tenant claims, role permissions, and potentially live sessions that don't expire for days. If the third-party server logs the token poorly, it could be stored in a centralized log aggregator or analytics database. This piece explains why JWTs are often misunderstood, how they work under the hood, and how to inspect them safely locally in your browser.
The first misconception is that JWT is signed, not encrypted. A JWT is a JSON Web Signature (JWS) and its payload is base64url encoded, not encrypted. Anyone can decode the claims with a few lines of JavaScript. If you need confidentiality, use JSON Web Encryption (JWE) instead.
A standard JWT consists of three parts separated by periods: the header, payload, and signature. The header defines the cryptographic algorithm and token type. The payload contains user identity and authorization metadata like user IDs, roles, and custom claims. The signature ensures data integrity by calculating a HMAC-SHA256 hash of the header and payload with a secret key. Altering even a single character in the payload will fail verification.
There are three critical vulnerabilities to avoid:
1. The "alg: none" attack, where an attacker changes the header to bypass signature verification on poorly written backend libraries. Enforce a whitelist of accepted algorithms on your server.
2. Confusion between symmetric and asymmetric keys. Never let the token header dictate which key verification function is used. Pin your verification logic to asymmetric verification.
3. Ignoring expiration. Stateless JWTs cannot be revoked without a centralized denylist. Keep token lifetimes short and use rotating refresh tokens stored in secure cookies.
To inspect tokens safely, use a client-side JWT Decoder that runs entirely in your browser sandbox. This way, the token never leaves your device, and you can instantly verify expiration, view the header and payload, and format claims without risking your production credentials.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
