Detection reference · Credentials and secrets · Updated 2026-11-03

JSON Web Tokens (eyJ…)

A JWT might be a session, a password-reset link, an API credential or a public anon key. Redaxa decodes the header and payload to tell you which, and is explicit that nothing about it is verified.

At a glance

Reported as	API key or token
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 205

What it looks like

Three base64url parts separated by dots, the first starting with eyJ, each at least 10 characters. Redaxa only treats it as a token if the header and payload decode to JSON with an algorithm.

Example 1

You paste

Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyZWRheGEtZG9jcy1zYW1wbGUiLCJyb2xlIjoiYWRtaW4ifQ.RedaxaDocsSampleSignatureNotRealRedaxaDocsS

Redaxa returns

Authorization: [SECRET]

Reported as	API key or token
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Probable service	Issuer not established
Credential type	JWT with privileged-role claim
Evidence	Decoded JWT claims are unverified. Neither the issuer, signature, owner nor expiry is authenticated by this check.
Recommended action	Revoke or rotate if genuine

Example 2

You paste

session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyZWRheGEtZG9jcy1zYW1wbGUiLCJleHAiOjE4OTM0NTYwMDB9.RedaxaDocsSampleSignatureNotRealRedaxaDocsS

Redaxa returns

session=[SECRET]

Reported as	API key or token
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Probable service	Issuer not established
Credential type	JWT token candidate
Evidence	Decoded JWT claims are unverified. Neither the issuer, signature, owner nor expiry is authenticated by this check.
Recommended action	Check issuer and session permissions

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

api/client.ts: JWT · privileged-role claim, listed for review (severity critical). The decoded payload declares a privileged role. Review access and rotate if genuine. Claims, signature and validity have not been verified.
Same value in tests/fixtures/client.ts: still listed for review. Found in a test file, but shaped like a real key rather than a placeholder. The decoded payload declares a privileged role. Review access and rotate if genuine. Claims, signature and validity have not been verified.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

token=eyJRedaxaDocsSa.RedaxaDocsSa.RedaxaDocsSa: not flagged. JWT-shaped, but the parts do not decode to a JSON header and payload: recognised as malformed and skipped.

If it already leaked

Find the service that issued it. Invalidate the session or rotate the signing secret with that service's own controls; removing the token from a file does not stop it working until it expires.

What Redaxa adds to every finding of this kind: Identify the issuing application and whether this token grants access. If exposed and usable, invalidate the token or session using that service’s controls. Removing the token from a repository does not invalidate it.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 205, credential-context.ts line 49 (Issuer not established). Every output on this page was produced by that code when the page was built.
RFC 7519: JSON Web Token