Privacy Policy

At JWT Toolkit, we believe that developer tools should be fast, reliable, and completely secure. Because you are pasting sensitive tokens and secrets, we have architected this tool to ensure your data never leaves your browser.

1. 100% Client-Side Processing

All token decoding, encoding, signature verification, and security analysis happens directly in your browser using JavaScript and the Web Crypto API. We do not send your JSON Web Tokens or secret keys to any backend server.

2. Data Collection & Analytics

To understand how developers interact with our application and optimize the toolkit, we use Tag Manager integrations to monitor basic website interactions, clicks, and usage patterns.

• No server-side logs or storage of your parsed input tokens
• No transmission of sensitive JWT payloads or cryptographic secret keys to third-party tools
• Only basic interface clicks and page views are monitored

3. Local Storage

To improve your experience, we may use your browser's localStorage to temporarily persist the token you paste. This allows you to seamlessly switch between the Expiry Checker, Decoder, and Security Analyzer without having to re-paste your token. This data is stored solely on your device and is never transmitted anywhere.

4. Client-Side Integrity

All token parsing, encoding, decoding, and signature verification are executed entirely within your own browser. No data is sent to a backend server. You can inspect your browser's Developer Tools (Network tab) at any time to verify that no network calls are made with your sensitive cryptographic keys or tokens.

5. Changes to this Policy

We may update this privacy policy from time to time. However, our core commitment to 100% client-side, serverless processing of your tokens will never change.