It also is sadly not fantasy. Security is all about habits, using such tools make you train bad habits. Sure jwt.io should be fine, but what about the depende

It also is sadly not fantasy. Security is all about habits, using such tools make you train bad habits. Sure jwt.io should be fine, but what about the dependencies they use to build it how through are they checked. What about domain hijacking, https downgrade attacks and similar. Etc. It's probably still all fine for jwt.io they probably use certificate pinning and similar. If you want to know how tricky attacks can become just look into the etherum dark forest article. Which had been posted here a few days ago. It's not a question if such attacks (based on undermining widely used web tools) happen it's just about when and how big the fallout will be.