How your data is handled

Don't trust this page. Check it.

Every tool site says it respects your privacy, including the ones that do not. A promise on a marketing page is worth nothing, and you have no way to audit our servers. So the useful thing this page can do is not to reassure you — it is to show you how to find out for yourself, in about thirty seconds:

1. Open your browser's developer tools (F12, or Cmd+Option+I on a Mac).
2. Switch to the Network tab and clear the list.
3. Come back to any tool here and use it — paste a token into the JWT decoder, format a document in the JSON formatter, generate a UUID.
4. Watch the list. Nothing appears, because nothing is sent.

There is a second test that is harder to fake: turn off your network connection entirely and keep using the site. It keeps working. That is only possible for a tool whose computation was never happening anywhere else.

Apply the same two tests to any developer utility you are about to paste something sensitive into. It is a better signal than any badge, policy or reassurance — including this one.

What actually happens when you use a tool here

You request a page. Our host sends back HTML, CSS, a small amount of JavaScript, and two font files. That exchange is a normal web request and it leaves a normal web server log entry — your IP address, the URL, a timestamp, a user agent — exactly as it would for any site on the internet.

Then the connection's job is finished. When you paste a JSON Web Token into the decoder, the JavaScript already sitting in your tab splits it, base64-decodes the halves and renders the result. No request is made because there is no API endpoint behind these tools and no backend that could receive one. We cannot see, log or store what you typed — not because of a policy decision that could quietly change, but because the data never travels to a place where we could.

That architecture has consequences beyond privacy, which is a good sign it is real rather than marketing: results appear as you type instead of after a submit, there are no rate limits or usage quotas, there is no sign-up, and the whole site keeps working on a plane.

What a typical online tool does instead

Developer utilities are a soft target precisely because the values people paste into them are sensitive by definition: session tokens, API keys, internal identifiers, customer rows copied out of a production log. The convenient habit — search, click the first result, paste — is one of the more common ways a live credential ends up on a server nobody audited.

Step	A server-side tool	This site
You paste a token	POSTed to a backend	Stays in the tab
It is processed	On someone else's machine	On yours
Request logs	May contain your token	No request was made
Third-party scripts	Usually ads and analytics	None
Works offline	No	Yes, once installed

No competitor is named here, and none should be inferred: plenty of server-side tools are run by careful people, and the point is not that they are dishonest. It is that a credential you sent somewhere is a credential you no longer control, regardless of how well-intentioned the recipient is.

What this site does keep — stated plainly

Volunteering the exceptions is what makes the rest of this page worth believing, so here they are in full.

• Two values in your browser's local storage: your light/dark theme choice, and the list of cities you added to the world clock. Local storage is never attached to a request, so these never leave your device. Clearing your site data removes them, and the world clock has its own "Forget them" control.
• Ordinary web server logs kept by our host for security and reliability: IP address, user agent, requested URL, timestamp. These record that a page was fetched. They cannot record what you did with it.
• Nothing else. No cookies, no analytics, no advertising script, no fingerprinting, no account, no email address, and no third-party requests of any kind — fonts and assets are all served from this domain.

On every tool page you will find a small panel showing two live counters: requests this page has made to any other server, and requests made since you started typing. Both are measured by your own browser's Performance Timeline rather than asserted by us. If either ever showed a number above zero, it would say so.

If you have already pasted a secret somewhere

Rotate it. Reissue the token, roll the API key, change the password. Do not spend the afternoon deciding how likely it is that the site retained anything — rotation takes five minutes and is the only action that actually restores the property you had before, and "probably fine" is not a security posture.

Then make the check above a habit. It costs half a minute the first time you use any tool site, and it is the difference between trusting a claim and knowing an answer.

The formal policy

This page explains how the site works. The privacy policy is the formal statement of it, including what happens if any of this ever changes — and the commitment that the policy is updated before the behaviour, never after.