How to prove an online JWT tool isn’t stealing your token

Most free JWT decoders ask you to paste a token.

That’s a trust problem. Tokens can include emails, roles, and session data. If the page uploads it, you just gave secrets to someone else’s server.

Here’s the fastest way to check any tool:

Use the Network tab

1. Open DevTools (F12)
2. Open Network
3. Paste a sample token
4. Watch for requests

If decoding fires a request with your token, leave.

A privacy claim is marketing. An empty Network tab is evidence.

Try a local decoder

I built a browser-only JWT decoder here:

https://kepttools.com/jwt-decoder

No account. Nothing uploaded. Open Network while you decode and confirm it yourself.

If you try it, tell me bluntly: is the privacy story clear in 5 seconds?