Stop Leaking Secrets: How to Decode JWTs Locally on Mac

Every web developer has done it. You are debugging a tricky authentication issue, you pull a JWT (JSON Web Token) out of your browser's local storage, and you paste it straight into jwt.io or some random "Gratuito Online JSON Formatter" site.

We all know we shouldn't do it. That token often contains sensitive user roles, PII (Personally Identifiable Information), or access privileges. Yet, we do it anyway because it's faster than writing a quick decoding script in the terminal.

But pasting sensitive production data into random web tools is a massive security risk. You have no idea if that site is logging your tokens, saving your JSON payloads, or scraping your data.

And recently, this exact habit blew up in our faces.

In late 2025, security researchers at watchTowr investigated popular code-formatting sites like JSONformatter.org and CodeBeautify.org. What they found was terrifying: they were able to scrape over 80,000 "saved" developer snippets that were left publicly searchable on these sites.

The leaked data included:

• Administrative JWTs and API keys
• Database and FTP credentials
• CI/CD pipeline secrets
• PII (like addresses and phone numbers)

When you paste a JWT into a random third-party website, you are handing a bearer token to a server you do not control. Even if the site claims to be "client-side only," there is no guarantee the data isn't being indexed for a "Share this snippet" feature.

Secure Alternatives for Decoding JWTs

If pasting into random websites is off the table, what are your options?

# Decode once
echo "$JWT" | jq -R -s 'gsub("\n"; "") | split(".") | {header: (.[0] | @base64d | fromjson), payload: (.[1] | @base64d | fromjson), signature: .[2]}'

# Or add a function to your ~/.zshrc
decodejwt() { echo "$1" | jq -R -s 'gsub("\n"; "") | split(".") | {header: (.[0] | @base64d | fromjson), payload: (.[1] | @base64d | fromjson), signature: .[2]}'; }

# Then pass the token as an argument:
decodejwt "YOUR_JWT_STRING"

const token = process.argv[2];
const [header, payload, signature] = token.split('.');
console.log(JSON.stringify({
  header: JSON.parse(Buffer.from(header, 'base64url').toString()),
  payload: JSON.parse(Buffer.from(payload, 'base64url').toString()),
  signature
}, null, 2));

import sys, base64, json
def dec(s):
    return json.loads(base64.b64decode(s + '=' * (-len(s) % 4)))
h, p, s = sys.argv[1].split('.')
print(json.dumps({'header': dec(h), 'payload': dec(p), 'signature': s}, indent=2))

const decodeJWT = (t) => t.split('.').slice(0, 2).map(p => JSON.parse(atob(p.replace(/-/g, '+').replace(/_/g, '/'))));
console.log(decodeJWT("YOUR_JWT_HERE"));

All of these solutions are 100% secure. But let's be honest: context-switching to a terminal, writing a command, and pasting the token every single time you need to check an expiration date is tedious.

The Best of Both Worlds: An Offline Native Tool

We need tools that are fast enough to beat the convenience of a web app, but secure enough to handle production data without the friction of CLI scripts.

That’s why I built L2Cache, a native macOS clipboard manager designed specifically for developers. Instead of sending your clipboard data to the web, L2Cache brings the web tools to your clipboard—completely offline.

When you copy a JWT, L2Cache automatically recognizes the pattern. You just click the Decode JWT button right in your clipboard history panel. The header and payload are instantly decoded and formatted as beautiful, readable JSON directly on your device.

The data never leaves your Mac.

Built-in JSON Formatting

The same goes for massive, minified JSON payloads returned from a curl command. Instead of tabbing out to jsonformatter.org (and risking adding to the 80,000 leaked credentials), you can use L2Cache's "Smart Actions" to format and syntax-highlight the JSON payload locally.

It's a subtle shift, but by moving these common formatting tasks out of the browser and into a secure, native macOS layer, you eliminate context switching and close a major security loophole in your daily workflow.

Protect your tokens. Keep your data local.