What a JWT leaks — and why not to paste production tokens online

A JSON Web Token looks like random gibberish, but it has exactly three parts separated by dots: header, payload, signature. Knowing what each part does is a security skill.

The signature prevents tampering — not reading

The header and payload are plain Base64URL: anyone holding the token can read claims like user id, email, roles and expiry with zero effort. The signature only proves the payload was not modified by someone without the secret key.

The classic pitfall: alg=none

If a server accepts tokens with the algorithm set to none, the signature is skipped entirely — a famous class of takeover bugs. Servers must pin the algorithm they expect.

Never paste production tokens into random sites

A session token is a bearer credential: whoever holds it can act as you until it expires. Pasting a live token into an unknown decoder hands your session to that site. If you need to inspect one, use a tool that decodes locally in the browser — like our JWT decoder, which never sends the token anywhere — and prefer test tokens in the first place.

Quick checklist

• Check exp before trusting a token
• Confirm the algorithm is the one your server expects
• Treat every token as readable, never secret

Inspect a token safely: decode it locally — payload and header render instantly, nothing is transmitted.