A jwt.io alternative with no trackers, and PASETO too

By Uxair Ijaz · 2026-11-06 · 5 min read

jwt.io is the first result most developers reach when they need to look inside a JSON Web Token. It is run by Auth0 (part of Okta), it is good at its job, and it decodes tokens in your browser. This article compares it with the JWT decoder on InTab: what each one does with your token, what else runs on the page, and where each is the better choice.

Disclosure: InTab is our site. We tested both sites on 6 November 2026 in a fresh browser, using a test token signed with a throwaway secret; details are below so you can repeat the test.

What happens to the token you paste

A JWT is a credential. If you paste a live access token, anyone who gets a copy can use it until it expires, so it matters where it goes.

Both sites decode the token in your browser. We pasted the same token into each site and recorded every network request the page made afterwards. Neither sent the token, or any part of it, anywhere.

• jwt.io made one request after the paste, a page-view event to Google Analytics, which did not contain the token.
• InTab made no requests at all after the paste.

So the question is not whether jwt.io uploads your token: in our test, it did not. The difference is what else is running on the page while the token is there.

What else runs on the page

Opening jwt.io in a fresh browser, without clicking anything, set 33 cookies. They included analytics and advertising cookies from Google, Meta, LinkedIn, X, Reddit, The Trade Desk and Adobe, plus Okta's own marketing cookies. That is normal for a company's marketing site, and the page's privacy notice says it may share personal information with advertising partners through cookies.

None of those scripts received the token in our test. But every script loaded on a page can, in principle, read what is on it, and a page that loads code from many companies has more places where something can go wrong. That is a good reason to prefer test tokens over live ones on any website, including ours.

InTab set no cookies. It counts page views with Cloudflare Web Analytics, which does not use cookies, and the site's Content Security Policy only allows the page to connect to the site itself and two named services (OCR language files and those page-view counts). The browser blocks everything else. The privacy page has the exact rule.

Side by side

✅ yes · ⚠️ partly · ❌ no. Based on each site on 6 November 2026.

Where jwt.io is stronger

• More algorithms. jwt.io supports the post-quantum ML-DSA-44, ML-DSA-65 and ML-DSA-87 signatures. InTab does not yet.
• Explanations of each claim. The claims breakdown describes every standard claim in a sentence, with a link to learn more.
• Learning material. The introduction, the free JWT Handbook and the libraries page, which lists JWT libraries for most languages, are excellent if you are new to tokens.
• Made by an identity company. Auth0 builds authentication for a living, and the debugger is maintained in the open on GitHub.
• Familiarity. Colleagues and documentation link to it, so it is the shared reference point when you debug a token together.

If you are learning about JWTs or need ML-DSA, use jwt.io.

Where InTab is the better fit

• Fewer third parties on the page. No cookies, no advertising scripts, and a security policy that the browser enforces.
• Expiry at a glance. Both sites turn exp and iat into dates, but InTab also says Expired, Not yet valid or Not expired, so you do not have to compare the date with the clock. In our test, jwt.io showed an expired token's date without saying it had expired. The timestamp converter is there for anything else.
• New keys on demand. When signing a test token, Random generates a new key pair for RS, PS, ES or EdDSA, so you can test with keys nobody else has, without OpenSSL.
• PASETO next to JWT. PASETO v4 is a newer token format with fewer ways to get security wrong, and v4.local tokens are encrypted, which a JWT normally is not. The PASETO guide explains when to choose it.
• The rest of the toolbox. Base64 for the token's parts, the JSON formatter for a large payload, and hashing and encryption tools, all on the same site with the same rules.

Repeat the test yourself

1. Open the site in a private window, then open developer tools (F12) and select the Network tab.
2. Clear the list, then paste a test token. Make one with the JWT encoder or any library, using a secret you do not use anywhere else.
3. Look at every request that appears after the paste. Use the filter box to search for a piece of the token's payload: if nothing matches, the token was not sent.
4. Check cookies under Application → Cookies (Chrome and Edge) or Storage → Cookies (Firefox).

Which one should you use?

• Debugging a token from work: either keeps the token in your browser. Choose the page with fewer third-party scripts, and use a test token where you can.
• Learning how JWTs work: start with jwt.io's introduction, or our short What is a JWT?
• Testing ML-DSA signatures: jwt.io.
• Testing PASETO, or creating key pairs quickly: InTab.

Whichever you use, treat a token you pasted as exposed if it was a live production token: let it expire, or revoke it if your system allows that.