Decode a JWT without pasting it into a website

What you are actually doing when you paste a token into a website

A JWT’s payload is base64url, not encryption. That is the part everyone knows, and it is the part that makes the habit feel harmless: the token isn’t secret in the sense that a password is, so pasting it somewhere to read the claims seems like pasting a receipt.

It isn’t. The token is a credential. Whoever holds it can act as the user it identifies until exp passes — which, for the tokens you actually want to inspect, is usually the ones minted minutes ago against production. Most decoder sites are honest and do the work in the browser. You cannot verify that from the outside, and “I checked the network tab once” does not survive a redesign, a new analytics tag, or an error reporter that helpfully serializes form fields. Even when nothing is uploaded, the token has now been through a text input on a page you do not control, and it is sitting in your session history.

The second cost is smaller and you pay it every single time: it is slow. New tab, type the address, wait for the page, paste, hunt for the one claim you wanted, select it, copy it, close the tab. Here is that minute, measured, against the same task in a clipboard manager that already decoded the token before you asked.

Decoding that never leaves the machine

Rakkun sits in the menu bar and watches nothing but your clipboard. Copy a token from a terminal, a header pane, a log line — anywhere — and press ⌘⇧V. It has already been classified as a JWT off the pasteboard.

What you see first is a mask. Because a JWT is a credential, Rakkun treats every one of them as sensitive by rule: the panel shows bullets, not claims, and the token is never written to the history file in the clear. The expiry badge is the one thing that stays visible — expires in 1 h 54 min, or more often than you would like, expired — because an expiry instant is a fact about the token rather than the secret inside it. It is usually the answer you came for anyway.

To read the rest, ask: hold ⌥ and the claims appear for exactly as long as you hold it, in the preview only. Or press ⌘L to unmark a throwaway token from your dev environment for good, and the full pane opens up — header and payload decoded into tables, with iat and exp annotated by the real dates they mean.

From there, ⌘C copies the payload as JSON, and ↩ pastes into whatever app you came from. Total: two keystrokes and no tabs.

Why “offline” here is a fact, not a promise

Every clipboard manager says your data stays on your device. Rakkun ships without a network entitlement at all. It is a sandboxed Mac App Store app, and the entitlement that would let it open a connection is simply absent from the binary — so the operating system refuses on the app’s behalf, whatever the app might want. There is no account to create, no sync to disable, and no server that could receive a token even by accident.

What it does not do

Rakkun decodes; it does not verify the signature. Nothing in the panel is an authenticity claim — it tells you what a token says about itself, which is exactly what you wanted when you copied it, and never that the token is valid. If you need verification, you need the signing key, and the signing key does not belong in a clipboard manager any more than it belongs in a web page.