Privacy Policy
Last Updated: October 11, 2026
100% Client-Side
Jwtly decodes and inspects JWTs entirely in your browser. No token, secret, or public key is ever uploaded to any server or saved by ToolBookly. There is no save feature and no database of tokens. Jwtly deliberately does not put JWTs or secrets into the URL hash or query string.
Decode vs verify
Decoding only reads the header and payload. Signature verification is optional and also runs only in your browser with a secret or PEM public key you provide. Anyone who has a JWT can still read its claims without a key — that is how JWTs work.
Data We Do NOT Collect
- ❌ No JWTs you paste
- ❌ No secrets or public keys
- ❌ No personal information
- ❌ No tracking cookies beyond aggregate analytics
Analytics
We use Google Analytics and Vercel Analytics for aggregate usage statistics only. No JWT content is collected. Analytics URLs are stripped of any fragment.