# JWT token leak detection

> PhishClean detects leaked JSON Web Tokens (JWTs) on web pages before attackers can steal them. Local detection, zero data collection.

Canonical: https://www.phishclean.com/features/jwt-token-leak-detection
Last updated: 2026-08-13

Pro feature

Auth0 reports that over 80% of web applications use JWTs for authentication — making token leaks one of the most widespread security risks on the web. Developers treat JWTs like session cookies, but they're really self-contained access passes — and when one leaks, the attacker doesn't need your password to become you.

## What JWT token leaks does PhishClean detect?

🎫

### Live session tokens

JWTs sitting in page source, URL parameters, or JavaScript variables. If it's on the page and it hasn't expired, anyone visiting can grab it and replay it against your API. That's instant account takeover.

🔓

### Expired tokens (still dangerous)

An expired JWT can't be used to authenticate directly. But it still leaks your user ID, email, role, and internal API structure — useful reconnaissance for a targeted attack.

⚠️

### Weak or unsigned tokens

JWTs using `alg: "none"` or HS256 with a guessable secret. These can be forged — an attacker changes `"role":"user"` to `"role":"admin"` and the server accepts it.

## What a JWT actually looks like

// Three base64-encoded parts separated by dots:  
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.  
eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwicm9sZSI6ImFkbWluIn0.  
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c  
// Anyone can decode the middle part. No key needed:  
{ "sub": "1234567890", "email": "user@example.com", "role": "admin" }

That middle section is just base64 — not encrypted. Anyone can paste it into jwt.io and read the contents. If this token appears anywhere on a web page, you have a problem.

## A real scenario

Here's something we see more often than you'd think: a developer adds `console.log(token)` while debugging authentication. It works, they ship the fix, and forget to remove the log statement. Now every user's JWT gets printed to the browser console — and any [injected script](https://www.phishclean.com/threats/formjacking-attacks) or [hidden iframe](https://www.phishclean.com/threats/hidden-iframe-attacks) on the page can read it.

Another common one: tokens passed as URL query parameters. `https://app.com/dashboard?token=eyJhbG...` — this gets logged by analytics tools, proxies, browser history, and any extension with URL access. If you're [storing tokens in localStorage](https://www.phishclean.com/blog/localstorage-token-security-risks), any XSS vulnerability on the page exposes them too.

## How does JWT leak detection work?

1

**Pattern scan.** When a page loads, PhishClean checks the page source, inline scripts, URL parameters, and localStorage for the telltale JWT pattern — three base64 segments joined by dots.

2

**Local decode.** Matched tokens are decoded right in your browser. We check the algorithm header, expiration claim, and what's in the payload — without sending anything anywhere.

3

**Risk rating.** A live admin token in page source? Critical. An expired token in a jwt.io tutorial? Low risk. Context matters, and we account for it.

4

**Alert with details.** You see the token type, whether it's expired, what roles it carries, and where on the page it was found. You decide what to do next.

## Why JWT leaks are different from other secret leaks

A leaked [API key](https://www.phishclean.com/features/secret-leak-scanner) is bad. A leaked JWT is often worse. Here's why:

- JWTs are self-contained. They carry everything needed to authenticate — the server doesn't need to look anything up. Whoever has the token *is* the user, as far as the API is concerned.
- Many JWTs have long expiration windows. We've seen tokens valid for 24 hours, 7 days, even 30 days. That's a long window for an attacker to operate in.
- Unlike API keys, JWTs typically can't be rotated without logging out the user. There's no "revoke this specific token" button in most implementations.
- Decoded JWTs reveal internal structure — user IDs, permission schemes, API endpoints — that helps attackers plan follow-up attacks even after the token expires.

PhishClean's JWT detection works alongside its other 13 signals. A JWT on a [phishing page](https://www.phishclean.com/threats/phishing-attacks) compounds the risk score. A JWT plus an [HTTPS downgrade](https://www.phishclean.com/threats/ssl-stripping-attacks) is a red flag that something is actively being intercepted.

## Related protection

- [Secret Leak Scanner API keys, private keys, database credentials — the other half of secret detection](https://www.phishclean.com/features/secret-leak-scanner)
- [localStorage token security Why storing JWTs in localStorage creates XSS risk](https://www.phishclean.com/blog/localstorage-token-security-risks)
- [API key leaks guide The full picture on secret exposure and prevention](https://www.phishclean.com/blog/what-are-api-key-leaks)

## Catch leaked tokens before they're exploited

PhishClean detects exposed JWTs on every page — locally, in real time. No tokens or page content are sent to our server for detection.

[Install PhishClean](https://www.phishclean.com/#install)

Last updated: 13 August 2026