JWT Decoder: Read the Claims

A JSON Web Token, or JWT, is three pieces of text joined by dots: a header, a set of claims and a signature. The first two are only base64url-encoded, not encrypted, so anyone who holds a token can read what it says. Developers sometimes forget that and put things in a token that should never be visible.

The decoder gives you a token issued by an invented app and one question about it. The question setting for this lab is auto. Split the token at the dots, decode the header and the claims, and find the value the question asks for. The signature stays on the server: you are reading the token, not forging one.

Send the value as your answer. The server checks it and returns the flag.

The lesson for building systems: a token proves who issued it, but it hides nothing. Never put a secret or personal detail in a claim that the holder should not read.