The JWT Decoder That Proves Most ‘Client-Side’ Tools Are Lying to You
Most JWT decoders ask you to trust they’re ‘client-side’ — but trust is not a security property. This decoder uses CSP connect-src ‘none’ to make token exfiltration technically impossible. The security guarantee is in the HTTP headers, verifiable by anyone with DevTools. No promises, no trust — just proof.