Encoding is not encryption
The header and payload of a common signed JWT are base64url encoded. They can usually be decoded without the signing key. The signature allows a verifier to detect changes, but it does not make the claims confidential.
Encrypted JWTs, often called JWE, are different. A simple three-part decoder does not inspect encrypted content.
Review identity and authorization claims
Look for sub, email, name, phone, user_id, account_id, tenant, organization, roles, permissions, groups, issuer, audience, and custom application fields.
Even values that look random may map directly to a user or customer record in your system.
Do not share live tokens
A token may grant access until it expires or is revoked. Redacting only the payload after posting the complete token does not remove the access risk.
Use a fabricated token or share only a cleaned decoded payload when the claim structure is the issue.
Separate privacy review from validation
A local decoder does not verify the signature, issuer, audience, expiry, revocation, key rotation, or server-side authorization rules.
Use the official application or server library for validation. Use the privacy checker only to understand what the readable token reveals.
Final review checklist
- No live production token is shared
- Custom claims reviewed
- Identity and permission claims masked
- Exposed tokens revoked
- Server-side validation used for trust decisions