Developer utilities handle the most sensitive text on the web. A JSON payload carries customer records and internal identifiers. A JWT is a live credential. A checksum is meaningless if you upload the file to compute it. Pasting any of those into a page that posts to a server is a data disclosure, not a debugging step.
Each of these runs entirely in your browser. The JWT decoder in particular will never ask for your signing secret, unlike several popular online debuggers: verification belongs in your own code, where the key already lives.
Questions
Can I safely paste a production token or payload?
Nothing is transmitted from these pages, and you can confirm that in the network tab. Even so, treat a production token as a password: prefer a short-lived test token, and rotate anything that has been in a chat or a ticket.
Why is there no JWT signature verification?
It needs the secret or public key. A page that asks you to paste your signing secret is asking for the ability to mint tokens for your system.
Which hash should I use?
SHA-256 for anything security related. MD5 and SHA-1 only for detecting accidental corruption, because both are broken against deliberate collisions.