These days with service workers and what not you might need more than a quick glance at the network log if you suspect the web page is malicious.

Even for non-malicious sites this can be a problem.

I think a notable case of the second category is jwt.io which last I checked definitely seemed to fire a few network requests after I pasted a token.

(Happy to be corrected if this is obviously false or has been corrected later.)

That said I couldn't see my token in one of them but it is scary enough to make me avoid using that site.

BTW, I think their statement/claim

> "Warning: JWTs are credentials, which can grant access to resources. Be careful where you paste them! We do not record tokens, all validation and debugging is done on the client side."

is correct, it's just to scary for me to put client credentials there at all when it isn't trivially east to prove that they aren't uploaded.