JWT decoder tools: what's safe, what's sketchy, and what I actually use

You're probably fine. But let me explain why. Every few months a thread pops up on Reddit or Slack: "Is it safe to paste my JWT into jwt.io?" The honest answer is: it depends on the token, and most devs already know the safe answer but want confirmation. Here's the thing about JWTs — they're not encrypted by default. They're just base64-encoded. Decoding the header and payload reveals the claims (user ID, roles, expiry, etc.) but not the signature secret . So pasting the payload into a decoder doesn't inherently expose anything a motivated attacker couldn't already get from intercepting the token in transit. But there are two real concerns worth thinking about: Access tokens with sensitive claims — Some JWTs contain internal user IDs, email addresses, org IDs, or permission scopes. Pasting those into a third-party site means you've sent that data to someone else's server. Trust surface — Even if jwt.io says it decodes client-side, do you know that for sure? Do you trust every CDN it lo