Quick PSA for anyone who pastes JWTs into online decoders: a lot of those sites forward your token to a server. For a production token that's a real leak vector. My rule is now: never decode a JWT anywhere that isn't 100% client-side.
Source: [Dev.to](https://dev.to/developer_tech/debugging-jwts-without-a-third-party-seeing-your-token-46cj)