Privacy

What happens to a token you paste

It is decoded, verified or signed by JavaScript running in your browser tab, using the browser's built-in WebCrypto API. It is not sent anywhere. It is not stored anywhere. When you close or refresh the tab, it is gone.

You do not have to take that on trust, which is the entire design goal. Open your browser's developer tools, switch to the Network tab, and paste a token into any tool on this site. You will see no request. Disconnect from the internet entirely and reload: every tool still works, because there is no server to talk to.

The source is public. It is a small amount of TypeScript, and it is worth ten minutes of your time if you are about to paste a production token into it.

Specifically, we never receive

• Tokens, or any part of a token — header, payload, signature.
• Secrets, private keys, public keys, or JWKS content.
• Claim names or claim values from your tokens.
• JWKS URLs that you type.
• Anything you type into any field on this site.

This is not a policy commitment that could quietly change — it is a property of how the site is built. There is no endpoint that accepts this data.

The one network request

The validator can fetch a JWKS from a URL you supply. That happens only when you click "Fetch JWKS", and the request goes directly from your browser to the server you named. It does not pass through us, and your token is not part of it — a JWKS fetch asks only for public keys.

In practice this request is usually blocked by the browser's CORS policy, because identity providers do not expect browsers to read their JWKS endpoints. When that happens we hand you a curl command instead. We deliberately do not offer a server-side proxy to work around it: routing your traffic through our infrastructure is precisely the thing this site exists not to do.

What we measure

Nothing. There is no analytics of any kind on this site: no third-party script, no first-party beacon, no cookies, no fingerprinting. The only usage information that exists is the ordinary server-side request count our host (Cloudflare) produces from serving the pages — which is to say, the fact that a page was loaded. Nothing about what you do on a page is measured or transmitted, ever.

This is verifiable, not promised: open devtools, use any tool on this site for as long as you like, and watch the Network tab stay empty. Then close the page — still nothing. The source is public if you want to confirm there is no code capable of sending anything.

Storage and cookies

This site sets no cookies. It writes nothing to localStorage, sessionStorage or IndexedDB. A service worker caches the site's own code so the tools work offline; it never caches or stores anything you enter.

Advertising

If and when this site carries ads, they will be developer-focused, served in sandboxed iframes that cannot read the page's DOM, and never placed adjacent to an input field. We will not use ad technology that scans page content or targets on the basis of what you type, for the obvious reason that the inputs on this site contain credentials.

Contact

Found a security issue — a token or key leaving the browser, an XSS, a crypto flaw? Report it privately through GitHub's private advisory form (details in our security policy), not a public issue. For anything else, open an issue on the repository.

Kalisada LLC. Last updated July 2026.