Developer tools
Consider what actually ends up in one of these boxes. The JSON you need formatted is an API response you are debugging, complete with bearer token, internal hostnames, and a few real customer records. The Base64 string you need decoded is a basic-auth header or a service-account key. The JWT you are inspecting is a live session token.
Pasting that into a tool that posts it to a server means it lands in someone else's request logs, and quite possibly their error tracker too. Nobody is being malicious; it is simply what happens when the transformation runs server-side. Running it in the page removes the question entirely.
Two of these tools deserve a specific warning, because their names mislead people. Base64 is not encryption — it is a reversible encoding with no key, so anything “protected” that way is effectively plain text. And the JWT decoder does not verify signatures; it shows you the claims. Verifying would need the signing key, which should never go into a web page, ours included.
Worth knowing before you start, rather than after.
