JSON Web Tokens (JWTs) are everywhere. Whether you're debugging an OAuth flow, a rogue microservice, or a broken single-page application, inspecting a JWT is a daily task for most developers.

But there's a massive, glaring problem with how we usually do it: We paste production tokens into random third-party websites.

Many online JWT decoders send your token to their backend to parse or verify it. If that token contains sensitive claims, PII, or internal routing data - and if it hasn't expired - you've just leaked it.

I was tired of wondering if a random tool was logging my tokens, so I decided to build a privacy-first JWT Inspector for my tool hub, ToolsMatic.

The goal? Zero backend. Zero dependencies.…