Debugging JWTs without a third party seeing your token

Quick PSA for anyone who pastes JWTs into online decoders: a lot of those sites forward your token to a server. For a production token that’s a real leak vector.

My rule is now: never decode a JWT anywhere that isn’t 100% client-side. I built a small tool that enforces that — header, payload and signature split with syntax highlighting, expiration checked live, and a network tab that shows zero outgoing requests.

It also covers Base64/Base64URL, URL encoding, and MD5/SHA-1/SHA-256/SHA-512 hashing, all in the browser: https://jwt-base64-inspector.vercel.app

The security guide behind it: https://jwt-base64-inspector.vercel.app/guides/jwt-security