Hide jwt.io link about jwt-cli

[douglasnaphas]

I respectfully disagree with the notion that it is risky behavior to parse a JWT using jwt.io. My reasoning is as follows.

In the jwt.io link printed by jwt-cli, the jwt is in the fragment. That is, it follows the hash symbol # and is not transmitted to the server. More broadly speaking, jwt.io states We do not record tokens, all validation and debugging is done on the client side. A violation of this promise would be a serious breach of trust by a very reputable company, Auth0, the maintainers of the site. In the absence of any instances of such an event, and in the absence of any illustration of how a JWT that is processed only client-side could be exploited, there is a low risk of anything bad happening, even to a new user, as a result of the jwt.io link being printed.

I suggest this issue be closed.

[troyharvey]

This is great. Thank you @douglasnaphas

[lareeth]

The suggestion was not that it was risky to parse JWT tokens using jwt.io, but it was risky to promote to users that they should be pasting jwt tokens online, no matter the site

I understand how jwt.io works, and clearly so do you, but to basic users, they have no idea and this is why I made this post.

Happy for this to be closed, as I seem to be alone with this worry 🙂