Most of us have done it: a request fails with 401, you copy the Authorization header, and you paste the token into the first JWT decoder a search engine offers. It works, and it also sends a live credential to a server you know nothing about.

What is actually in a token

A JWT is three base64url-encoded parts joined by dots: a header, a payload, and a signature.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NSIsImV4cCI6MTc5MjAwMDAwMH0.g1glroEtnKkICg4P8HdXwM908l-aTM3W3jT4UGnOaFE

Decoded, the first two parts are plain JSON:

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "12345",
  "exp": 1792000000
}

The header says how the token was signed. The payload carries the claims: who the token is about (sub), when it expires (exp), and whatever else the issuer put there. None of it is encrypted, which is exactly why it should not travel anywhere it does not need to.

Verifying is the important part

Decoding tells you what a token says. Verifying tells you whether to believe it. For HS256 that means recomputing an HMAC with the shared secret; for RS256 or ES256 it means checking the signature against a public key.

import CryptoKit

let key = SymmetricKey(data: Data(secret.utf8))
let signingInput = Data("\(header).\(payload)".utf8)
let isValid = HMAC<SHA256>.isValidAuthenticationCode(signature, authenticating: signingInput, using: key)

Why on device

Segments does all of this locally with CryptoKit. Tokens, secrets and keys never leave the Mac or iPad, there is no telemetry, and it works offline. It is also free.

If a token is good enough to log in with, it is too good to paste into a stranger’s text box.