Back to feed
Dev.to
Dev.to
6/30/2026
The headline is about JWT security - pasting JWTs into online decoders leaks credentials, and there's a browser-only fix.

The headline is about JWT security - pasting JWTs into online decoders leaks credentials, and there's a browser-only fix.

Original: Pasting a JWT Into an Online Base64 Decoder Is a Credential Leak — Here's the Browser-Only Fix

Short summary

Pasting JWTs into online base64 decoders is a credential leak: even honest servers log the request, exposing live bearer tokens that remain valid for another hour. Browser's atob() won't work on base64url-encoded JWTs without a normalization step; the author explains why naive developers hit DOMException. The solution is client-side decoding with proper base64url conversion and UTF-8 handling, with working code provided.

  • •Online decoders are a credential leak—they transmit live bearer tokens to unknown servers
  • •Browser atob() fails on base64url format (using - and _ instead of + and /); normalization is required
  • •UTF-8 encoding pitfalls and working implementation provided with edge-case handling

Generated with AI, which can make mistakes.

#ai-tools#certification-education
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Stop pasting JWTs into random websites
Dev.to
How to Decode JWT Tokens Without a Backend
Dev.to
atob() can't decode a JWT — the Base64URL gotcha (and the fix)
Dev.to
The original title is: "What's Actually Inside a JWT (and Why Decoding One Isn't Verifying It)"
Dev.to