Why it runs in your browser

A token is a live credential. Sending one to a third-party server to be inspected means trusting that server not to log it, so this page does the asking itself: the requests go from your browser straight to the provider, and the token never reaches any machine of ours. There is no backend to trust because there is no backend.

That is also the limit on which services can be supported. A provider has to allow a cross-origin request carrying an Authorization header, and that is the provider’s decision, not ours. npm, Docker Hub and several others refuse it outright. The honest answer there is that they are unsupported, rather than quietly routing your credential through a proxy.

Nothing from the token is kept. It lives in a variable while the tab is open and reloading clears it. The only thing this site stores in your browser is which theme you picked, and the only thing it records is an anonymous page view through Umami, which never sees the token or anything read with it.