How I built a zero-dependency, 100% client-side JWT Verifier using the Web Crypto API

JSON Web Tokens (JWTs) are everywhere. Whether you're debugging an OAuth flow, a rogue microservice, or a broken single-page application, inspecting a JWT is a daily task for most developers. But there's a massive, glaring problem with how we usually do it: We paste production tokens into random third-party websites. Many online JWT decoders send your token to their backend to parse or verify it. If that token contains sensitive claims, PII, or internal routing data - and if it hasn't expired -