JSON Web Tokens (eyJ….eyJ….…)

How nullcipher recognises it

Three base64url segments joined by dots, where the first segment decodes to a JSON object with an "alg" field.

This is the rule text of the “JSON Web Token” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJFWEFNUExFIiwibmFtZSI6IkV4YW1wbGUgVXNlciIsImlhdCI6MTUxNjIzOTAyMn0.EXAMPLE_signature_not_valid

nullcipher replaces it with [JWT_1]. The header decodes to {"alg":"HS256","typ":"JWT"} and the payload to {"sub":"EXAMPLE","name":"Example User","iat":1516239022}. The signature is the words EXAMPLE_signature_not_valid, so no server would accept it.

Why it matters in an AI chat

A JWT is usually a session or access token. A server that receives it treats whoever presents it as the logged-in user, without asking for a password, until it expires.

Its middle part is only base64url-encoded, not encrypted. Anyone can read the claims inside — user ID, e-mail, roles, tenant — without any key.

JWTs reach chats in Authorization: Bearer headers, browser dev-tools copies, curl commands and API logs.

If it already leaked

1. Look at when it expires. The JWT standard says a token MUST NOT be accepted on or after the time in its exp claim, so a token that expired minutes after the paste is already dead. One that runs for days, or has no exp at all, needs action. ^[1]
2. Sign out of the service it came from, or use its sign-out-everywhere option if it has one. Many services end the session behind the token that way. A purely stateless JWT, though, stays valid until exp whatever you do in the app.
3. If you run the service that issued it: rotate the signing key (the secret or private key for the alg in the header). Every token signed with the old key then fails verification, which logs everyone out, including whoever has the leaked token.

Sources

1. RFC 7519: JSON Web Token (JWT), section 4.1.4 "exp" (Expiration Time) Claim — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.