Privacy Policy
Your data stays
on your machine
We mean it. JWT Decoder is a client-side tool — no token, email address, or personal detail ever touches our servers. This policy explains exactly what we do (and don't) collect.
01 Information We Collect
When you visit JWT Decoder, our web server receives a standard HTTP request. This request may include:
- Your IP address (processed transiently by the server to serve the HTML page)
- The HTTP User-Agent string sent by your browser
- The date and time of the request
These are standard server logs required to deliver any website. They are not linked to your identity, not stored long-term, and not used to profile you. We do not run any server-side analytics software on this data.
| Data type | Collected? | Purpose |
|---|---|---|
| JWT tokens you decode | ✓ Never | Processed entirely in your browser; never transmitted |
| Personal identifiers (name, email) | ✓ Never | No accounts, no registration required |
| Cookies or tracking pixels | ✓ None set | Not applicable |
| Behavioural / analytics data | ✓ Never | No analytics SDK is loaded |
| IP address (transient server log) | Briefly, per request | HTTP routing only; not stored or analysed |
| Contact form submissions | Only if you submit | To respond to your message (see §5) |
02 How Token Decoding Works
All JWT decoding is performed using JavaScript that runs inside your web browser. The process is:
- You paste a token into the text area.
- JavaScript in the page splits the token on the
.character and applies Base64url decoding (RFC 4648 §5) to the header and payload segments. - The decoded JSON is displayed in your browser window.
At no point is the token sent over a network. You can verify this yourself by opening your browser's DevTools → Network tab and observing zero outgoing requests when you click "Decode".
03 Cookies & Local Storage
JWT Decoder sets no cookies — neither first-party nor third-party. We do not use localStorage, sessionStorage, or any other browser-based persistence mechanism to store your data between sessions.
Because we set no cookies, there is no cookie consent banner to dismiss, and no cookie preference centre to manage. If you ever see cookie storage under our domain in your browser's DevTools, it has been set by your browser or a browser extension, not by us.
04 Third-Party Services
Google Fonts
We load two typefaces (Space Mono and Syne) from Google Fonts CDN (fonts.googleapis.com). This causes your browser to make a request to Google's servers to download the font files. Google may log this request according to their privacy policy. The fonts are loaded purely for display purposes; no other data is shared with Google in this process.
If you prefer to avoid this request entirely, you may use a browser extension to block Google Fonts CDN. The page will fall back to system monospace and sans-serif fonts.
No Other Third Parties
We do not load any advertising networks, tracking pixels, social media widgets, analytics SDKs (such as Google Analytics, Mixpanel, Segment, or similar), or any other third-party JavaScript libraries beyond Google Fonts.
05 Contact Form Data
If you submit a message via our Contact page, we collect:
- Your name
- Your email address
- The subject category you select
- The message body you type
This information is used solely to reply to your query. We do not add you to any mailing list, share your details with third parties, or use your contact data for any purpose other than responding to your specific message.
Contact form submissions are retained for up to 12 months and then permanently deleted, unless a longer retention is required by law or ongoing correspondence.
The legal basis for processing this data (under GDPR Article 6) is legitimate interest — specifically, the legitimate interest of responding to voluntary enquiries you have initiated.
06 Data Retention
| Data | Retention period |
|---|---|
| JWT tokens decoded via the tool | Not retained (never transmitted) |
| Transient server access logs (IP, User-Agent) | Overwritten automatically within 7 days |
| Contact form submissions | Up to 12 months from receipt, then deleted |
| Cookies / local storage | Not applicable (none set) |
07 Your Rights (GDPR / CCPA)
If you are located in the European Economic Area (EEA), United Kingdom, or California, you have certain rights regarding personal data we hold about you:
- Right of access — request a copy of any personal data we hold about you.
- Right of erasure — request deletion of your personal data ("right to be forgotten").
- Right to rectification — request correction of inaccurate personal data.
- Right to restriction — request that we restrict processing of your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest.
- CCPA right to opt-out of sale — we do not sell personal data. This right does not apply but we state it for completeness.
Because we collect almost no personal data through normal use of the tool, in most cases there is nothing to access, erase, or export. For contact form data, you may exercise any of these rights by contacting us. We will respond within 30 days.
08 Children's Privacy
JWT Decoder is a developer tool intended for adults. We do not knowingly collect personal information from children under the age of 16. If you believe a child has submitted personal information through our contact form, please contact us immediately and we will delete it.
09 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. We encourage you to review this policy periodically. Continued use of JWT Decoder after any changes constitutes acceptance of the revised policy.
For material changes (e.g. introducing any form of data collection that does not currently exist), we will make a reasonable effort to provide notice — such as a prominent notice on the home page — for at least 30 days before the change takes effect.
10 Contact Us
If you have any questions, concerns, or requests related to this Privacy Policy or your data, please get in touch:
Privacy Questions
We take privacy seriously and respond to all data-related enquiries within 5 business days. For urgent security disclosures, mark your message "Security" in the subject.
[email protected] · Use the contact form