Why You Should Never Paste JWTs Into Online Decoders — And What to Do Instead

·1 views

JSON Web Tokens (JWTs) are bearer credentials that remain valid until expiry, making them as sensitive as passwords. Many online JWT decoder tools send pasted tokens to their backend servers, where they can be logged and potentially misused by bad actors. Because the header and payload sections of a JWT are simply Base64URL-encoded — not encrypted — they can be decoded entirely in the browser using native JavaScript without any external service. Developers are advised to use browser-console snippets or client-side-only tools that make no network requests when inspecting token contents. It is also important to distinguish decoding, which reveals claims, from verification, which requires the signing secret or public key to confirm a token's authenticity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Reliable Cross-Border 2FA SMS OTP System in Node.js

A technical guide outlines a contract-based approach for handling SMS one-time password (OTP) authentication across US and EU regions in Node.js applications. The core principle is that the application — not the SMS provider — must own the OTP challenge state machine, covering actions like issue, verify, resend, cancel, and expiry. The SMS API is treated purely as a transport layer, with no authority to reopen or validate a terminal login challenge. Key design rules include idempotency for resend and cancel operations, atomic verification, and multi-dimensional rate limiting across account, IP, destination, and country policy. Country-specific compliance constraints such as sender rules, consent requirements, and throughput limits should be managed through policy configuration rather than scattered conditional logic in code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

European Cloud Infrastructure Faces a Maturity Gap Despite Growing Demand

European cloud providers are beginning to expand into managed runtimes and hosted inference, but engineers widely agree that no European player yet wins on capability, tooling, or reliability alone. Around 60% of Western European CIOs plan to increase use of local cloud providers, signaling strong demand, yet the gap remains technical rather than one of provider count or intent. The EU's proposed Cloud and AI Development Act, introduced on 3 June 2026, would create four assurance levels to govern which providers can serve public sector and critical infrastructure clients. On 25 June 2026, the European Commission also moved to designate the two largest cloud services operating in the EU as gatekeepers under the Digital Markets Act, marking the first time that law has targeted infrastructure. Critics argue that asking developers to pay a premium for less capable infrastructure on sovereignty grounds has eroded trust, with buyers privately describing European cloud as unable to satisfy both compliance and engineering requirements simultaneously.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to RDP Into a Proxmox VM Securely Using SSH Tunneling

A developer running an Ubuntu Desktop VM on Proxmox found a way to access it via RDP without exposing port 3389 to the local network. The approach uses SSH port forwarding to tunnel RDP traffic through an already-trusted SSH connection to the Proxmox host. On the VM, xrdp is installed as usual, while the laptop's SSH config is set up with a LocalForward directive that maps local port 3389 to the VM's port 3389. Once the SSH tunnel is active, the RDP client connects to localhost:3389 with all traffic encrypted inside the SSH session. Users are advised to assign the VM a static IP or DHCP reservation, as a dynamic IP change after reboot would break the tunnel configuration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agents Are Making Story Points and Sprints Obsolete

As AI coding agents become central to software development, traditional Scrum metrics like story points and two-week sprints are losing their relevance, according to a framework published on DEV Community. Because AI agents can execute both simple and complex tasks in near-identical timeframes, measuring human effort no longer reflects actual delivery capacity. The proposed model shifts the fundamental planning unit from user stories to business objectives, using statistical forecasting and continuous flow instead of Fibonacci estimation and fixed sprints. Spec-driven development tools replace the product backlog, with AI generating architectural specs, decomposing them into testable tasks, and validating outcomes automatically. Engineering teams are advised to focus on governance and system throughput, while testing evolves into a continuous loop targeting full behavioral coverage rather than line-coverage percentages.

0 comments Read more at DEV Community