Prefer the dev tools on this site: JSON, JWT, regex, timestamps. They are built to run in the page.
Test once offline. If you still get a result after refresh, it is not depending on our backend. Upload-based features are a different case.
Clear the input when finished. Do not leave production JWTs or secrets in screenshots or tab history.
The same rule applies to MCP: prefer read-only, and never reuse a production secret in a local config you might commit.