Every JWT debugger tells you not to paste real tokens. So I built one where it doesn't matter.

Short summary

The author built TokenBench, a fully client-side JWT debugger using WebCrypto so no token data ever leaves the browser. Motivated by a real incident where a tool collapsed signature and expiry errors into one red banner—costing an hour—the tool separates those checks and refuses to perform algorithm-confusion attacks. The author also removed all analytics after realizing even a harmless beacon contradicted the zero-data-leaving promise.

• •TokenBench runs all JWT operations client-side via WebCrypto—nothing leaves the browser
• •Separates signature validation from expiry checks, preventing common misdiagnosis
• •Refuses alg-confusion operations and removed all analytics to keep privacy claims literal

Generated with AI, which can make mistakes.