PRIVACY PROMISE

Your token stays in your browser.

easyjwt has no account system, analytics, advertising, API, database, tracking pixel, or third-party script.

What we collect

Nothing. The page does not send the JWT, decoded claims, signing key, or verification result to a server. There is no form submission and no browser storage for token or key material.

What happens locally

Parsing, linting, timestamp conversion, signature verification, and signing run in browser memory using JavaScript and the browser Web Crypto API. Reset clears the inputs from the current page. Closing or reloading the tab discards them.

Network isolation

A restrictive Content Security Policy blocks outbound browser connections. The service worker additionally rejects cross-origin runtime fetches and caches only first-party static assets. The initial document and static assets must still be downloaded from the host; this is not a claim that browsers can render a website without fetching it.

Use with care

A local tool reduces disclosure risk but cannot protect a token already exposed by your browser, extensions, screen sharing, clipboard manager, device, or a compromised machine. Only paste credentials you are authorized to inspect.