Why offline dev tools matter

Every "online JWT decoder" and "paste your JSON here" site is a security incident waiting to happen. Access tokens, API keys and internal data structures pasted into someone else's server end up in logs, backups and — in the worst cases — public dumps. This utility hub runs 100% in your browser: no request, no logging, no risk. Verify by opening DevTools → Network and pasting any secret: zero outbound traffic.

When to use each tool

Base64 — inspect tokens, encode images for data URLs, decode HTTP Basic auth headers
JWT — debug OAuth flows, inspect claims, check token expiry
UUID v4 — generate primary keys, request IDs, correlation IDs
JSON — pretty-print API responses, minify for size, validate structure
URL encoding — build safe query strings, debug encoded params, decode percent-encoded strings

JWT security note

JWTs are signed but not encrypted by default. Anyone with the token can read its payload — decoding does not require the secret. This means: never put passwords, PII or secrets inside a JWT payload. Assume every JWT you issue can be read by the token holder.