KeptTools: browser-only developer tools that don’t upload your paste

Fair points — thanks for the precise pushback.

You’re right on the privacy wording: “nothing leaves your browser” means we don’t upload the paste to our servers. It doesn’t protect against a malicious extension or someone with access to the machine/DOM. I’ll tighten that language so the claim stays honest.

On JWT: decode-only is intentional today, and the page already notes it doesn’t verify the signature — but I agree a decode-only view can still create false confidence if someone skim-reads. Optional local verification with a pasted secret (for staging) is a strong feature request; I’ve noted it.

Appreciate the threat-model feedback.