What a JSON Web Token looks like

Three base64url parts separated by dots. The first two always start with eyJ, which is {" encoded, because they are JSON. The payload is only encoded, not encrypted: anyone can read the user ID, email and roles inside.

A fake example, in the right format:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1XzQ4MjEzIiwiZXhwIjoxNzYxMTAwMDAwfQ.Fak3S1gnatur3F0rD3m0

ScrubLogs replaces it with <JWT_1>.

Why a leak is dangerous

A valid token lets whoever holds it act as that user until it expires, and its payload leaks personal data even after it expires.

If yours leaked: rotate it

Redacting a copy doesn’t un-leak the original. If the real value was shared anywhere, replace it:

1. Most JWTs can’t be revoked one by one. Sign the user out or revoke the session or refresh token server-side.
2. If the signing secret itself leaked, rotate it. That invalidates every token at once.
3. Keep access tokens short-lived so a leaked one stops working quickly.