# Redact JSON Web Tokens

> Redact JWTs from debug output, HAR files, and support tickets before they leave your environment.

Canonical: https://bitbanger.in/entities/jwt
Last updated: 2026-10-27

Category: Credentials and secrets · Entity type: `credential.jwt`

A JWT is a bearer credential. Anyone holding one can act as the user until it expires, and pasted browser network logs are full of them.

## How Redactly detects JSON Web Tokens

- Matched by regex for the three dot-separated Base64URL segments that begin with the eyJ header.
- Runs independently of the model, so a token in a header dump is caught.
- The whole token is replaced, not just the payload segment.

## Why redact JSON Web Tokens?

JWTs are self-contained credentials: whoever holds one is authenticated until expiry.

## Example request

```bash
curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.dBjftJeZ4CVPmB92K27uhbUJU1p1r_wW1gFWFOEjXk", "style": "replace"}'
```

## FAQ

**Does Redactly redact JSON Web Tokens automatically?**

Yes. Send text to the API and every detected type is redacted, including JSON Web Tokens. To redact only this type, pass the value credential.jwt in the entities filter. No training or configuration is required.

**What happens to JSON Web Tokens after redaction?**

With style set to replace, each match becomes [credential.jwt] — the entity type in square brackets. Setting style to mask replaces every character with a block character, and remove deletes the span entirely.

## Related entity types

- [API keys](https://bitbanger.in/entities/api-key) — Redact AWS, OpenAI, Anthropic, GitHub, Google, Slack, and Hugging Face API keys from logs and pasted text.
- [Passwords](https://bitbanger.in/entities/password) — Redact plaintext passwords from configuration dumps, tickets, and transcripts before they are shared.
- [Login credentials](https://bitbanger.in/entities/login-credentials) — Redact username and password pairs from pasted transcripts, config files, and support threads.

Try it on your own text: https://bitbanger.in/entities/jwt