Privacy Policy — JWT Decoder
Last updated: 24 August 2026
JWT Decoder is an Android app that decodes, inspects and verifies JSON Web Tokens. This policy explains what the app does and does not do with your data. It applies to the app published on Google Play with the package name com.tahatec.jwt_decoder.
The short version
Your tokens never leave your device. Every token you paste or send to the app is decoded on the phone itself, and every signature is checked on the phone itself. There is no account, no sync, and no server that receives your content.
Keys and secrets are never stored. A signing secret or a public key you enter to check a signature exists only in memory while that screen is open. It is not written to storage and not transmitted.
The app records anonymous usage statistics and crash reports so it can be improved. These never contain a token, any part of a token, a claim value, an issuer, a key identifier, a key or a secret.
The app shows ads. Ad providers collect their own data, described below.
Tokens you decode
When you paste a token, type it, or send one to the app from elsewhere, it is held in the app's memory and decoded on the device. It is not transmitted anywhere.
A JSON Web Token is a credential: while it is within its validity period, anyone holding it may be able to act as its subject. The app is built around that fact.
By default the app keeps your most recent tokens — up to 20 — on the device so you can return to them. That history:
is stored only in the app's private storage on this device;
is excluded from Android cloud backup and from device-to-device transfer, so a stored token is never copied off the phone it was decoded on;
is shown as a masked token in the list, and asks for confirmation before revealing one in full;
can be cleared at any time from the Recent tokens screen; and
can be switched off entirely under Settings → Remember tokens, which also deletes whatever is already stored.
Keys and secrets you enter
To check a signature you may enter a shared secret or a public key. That value is held in the text field for as long as that screen is open and is then discarded. It is never written to storage, never included in analytics or crash reports, and never transmitted. The app has no code path that could do any of those things.
What is collected, and by whom
Service What it receives Why
Google Analytics for Firebase Anonymous usage events: which action you took, whether the token was a signed or an encrypted one, the signature algorithm when it is one of the standard registered names (for example RS256), a bucketed claim count, the outcome of a signature check, the app language, the theme mode, plus a Google-generated app instance identifier and standard device and country information. No token, no part of a token, no claim value, no issuer, no key identifier, no key and no secret. To see which features are used and which messages need improving.
Firebase Crashlytics Crash and error reports: stack traces, device model, OS version, and the app state at the time. No token content and no key material. To find and fix crashes.
Firebase Cloud Messaging A device notification token, and the fact that this install subscribed to the topic all_users. Only if you allow notifications. To send occasional announcements about the app.
Google AdMob, and Meta Audience Network as a mediated ad source Data used to select and measure ads, which may include your advertising identifier, IP address (and the approximate location it implies), device and app information, and ad interactions. To show ads, which fund the app.
These are third-party services and their own policies govern what they do with that data:
Google (Firebase and AdMob): policies.google.com/privacy and firebase.google.com/support/privacy
Meta Audience Network: facebook.com/privacy/policy
Ad consent in the EEA, the UK and Switzerland
If you are in a region that requires it, the app asks for your consent through Google's certified consent management platform before any personalised ad is requested. You can change your answer at any time using the Ad privacy choices item in Settings, which appears wherever it is required.
Permissions the app requests
Internet — for ads, analytics, crash reports and notifications. The app never uses it to send a token, a key or a secret.
Notifications — asked for only after you have used the app, and only so announcements can be delivered. Declining changes nothing else.
The app also accepts text shared to it from other apps, and appears in the text-selection menu as Decode JWT. Text arrives only when you choose to send it; the app cannot read another app's content on its own.
Children
This app is a developer utility and is not directed to children under 13. It does not knowingly collect personal information from children.
Your choices
Clear stored tokens from the Recent tokens screen, or switch the feature off under Settings → Remember tokens, or clear all app data from Android Settings.
Change or withdraw ad consent from Ad privacy choices in Settings.
Reset or delete your advertising identifier in Android Settings > Privacy > Ads.
Turn notifications off in Android Settings for the app.
Uninstalling the app removes everything it stored on the device.
Changes
If this policy changes, the date at the top of this page changes with it.
Contact
Questions about this policy:
support@tahatec.com