Hacker News Reader

Not sure if you fully read the article, but I mention that up until fairly recently, jwt.io was performing some metric collection, which I'm not sure many people were aware of

did you validate that those sites do not batch data input over time and send them out, much later than your direct user input interactions?

Open in private window, set to offline in the console's network tab, do your thing, close the window. At least I'm not aware of a way the app could send or persist the data when you do that.

If the app runs locally in the browser, you monitor network connections and whatever else for web sockets, etc, to ensure that no information is passed from your browser to the site beyond the initial http request, then, there never would be any information sent to the site to batch, correct?

I think that is correct.

Also I agree with previous posters who pointed out that for the common JWT use-case: user authentication in an SPA or website, the JWT is running in users browsers and so should not contain any sensitive information to begin with.

How will you know if the code changes?