Privacy

The whole site rests on one claim: what you paste into a tool does not leave your browser. A claim like that is worth nothing unless it is specific enough to check. This page is the specific version, including the parts that are less flattering.

What the tools do with your input

Nothing leaves the page. Every free tool on this site — the diff, the JSON formatter, the JWT decoder, the hash generator — does its work in JavaScript running on your own machine. There is no server-side processing because there is no server beyond the one that handed you the file. No request carries your input anywhere, because no request is made at all after the page has loaded.

Files you drop are read by your browser through the standard file API and never uploaded. That is the difference that matters when the file is the thing you are checking.

What is stored on your device

Two things, both in localStorage, both set by you, neither sent anywhere:

Clearing site data in your browser removes both. Nothing else is stored, and the site sets no cookies of its own.

What is not here

What does happen, honestly

Two things do involve a third party, and it would be misleading to leave them out.

The host sees the request for the page

This site is served by Cloudflare. Like any web host, Cloudflare processes the HTTP request that fetches a page — which means your IP address, your browser's user agent and the URL you asked for pass through its network. That is unavoidable for any website on the internet, and it applies to the page request only. It does not, and cannot, include anything you subsequently type into a tool, because that never becomes a request.

Search engines are told the site exists

The site is registered with Google Search Console, which reports aggregate search statistics — which queries showed the site, how many people clicked. That data comes from Google's side of the search results, not from a script on this page, and it says nothing about what any individual did once they arrived.

How to check any of this yourself

Do not take the claim on trust. It takes about a minute to verify.

The paid tools, when they exist

Some tools cannot work this way. A request bin or a mock SMTP inbox has to receive traffic from somewhere else, which means a server, which means an account so it knows whose captured requests are whose. Those will be paid, they will be kept visibly separate from the free tools, and this page will be updated to describe exactly what they store before any of them accepts data. The free tools above are not affected and will not be metered later.

If something here is wrong

If you check one of the claims above and find it does not hold, that is a fault worth reporting, not a detail. The point of writing it this specifically is that it can be falsified.

The tools