Privacy

The short version

Most tools on this site do their work inside your browser. For those tools, the file or text you give them never leaves your device — not to us, not to anyone. There is no account to create and nothing to sign in to.

Tools that keep your data on your device

These 20 tools run entirely in JavaScript on your device. Once the page has loaded, they keep working with your network disconnected — which is the simplest proof that nothing is being sent anywhere:

• Base64 Encoder / Decoder — Encode text or files to Base64, and decode it back.
• Hash Generator — SHA-256, SHA-384 and SHA-512 for text or a file.
• HTML Entity Encoder / Decoder — Escape text for HTML, and turn entities back into characters.
• Image Compressor — Shrink JPEG, PNG and WebP images without uploading them.
• Image Converter — Convert between WebP, JPEG and PNG, and see which is smallest.
• Image Cropper — Crop, rotate and flip an image without uploading it.
• Image Resizer — Resize an image to any size, in your browser.
• JSON Diff — Compare two JSON documents and see exactly what changed.
• JSON Formatter — Format, validate and inspect JSON.
• JSON to CSV — Turn JSON into a spreadsheet-ready CSV file.
• JSON to JSON Schema — Infer a JSON Schema from a sample document.
• JSON to TypeScript — Generate TypeScript interfaces from a JSON sample.
• JSON to YAML — Convert JSON into readable YAML.
• JWT Decoder — Read what a JSON Web Token says — without verifying it.
• Markdown to HTML — Convert Markdown to clean HTML, with a live preview.
• Regex Tester — Test regular expressions against your text, live.
• Timestamp Converter — Convert Unix timestamps to dates, and back.
• URL Encoder / Decoder — Percent-encode and decode URLs and query values.
• URL Parser — Break a URL into its parts, and strip the tracking off it.
• UUID Generator — Generate random UUIDs, in bulk.

Every tool page states its own execution model in a badge near the top, and that badge is generated from the tool's configuration rather than written by hand, so it cannot drift out of date.

Tools that need a server or an AI service

There are none yet. When we add one, it will say so clearly on its own page and in the list above before you give it anything.

The Webhook Inspector

The Webhook Inspector is the one thing here that has to involve our server, because its whole job is to be an address another service can send to. It is a paid product with a free plan, and the sentence above about nothing leaving your device does not describe it. Here is what does.

Credentials and personal data are stripped out before anything is written down — inside the request that received the payload, so the unredacted bytes are never on our disks at all. That covers authorization and cookie headers, signing-secret headers, private keys, API tokens from the services people actually use, email addresses, and anything else with the shape of a secret. Each captured request says what was removed and how many times, so nothing goes missing silently.

If that is not enough, an endpoint can be created with encryption switched on. Your browser generates a key, keeps the private half in the page's own address — the part after the #, which browsers never send to a server — and we seal every payload to it. We can store your data and we cannot read it. Lose the link and the data is unrecoverable, and that is deliberate: it is what makes the promise true.

We store the sending service's IP address with each request, because it is the one piece of diagnostic information nobody can reconstruct later. Everything is deleted on a clock — 7 days on the free plan, longer on the paid ones — and a capture's IP address goes with it. Accounts exist only so that a subscription belongs to somebody who can cancel it; the tools need none, and nor does the free endpoint.

What we measure

We want to know which tools are worth improving, so we may count things like “the JSON formatter was used” or “a conversion failed”. We do not record the content you paste, upload or generate. Analytics are off unless a privacy-respecting provider is configured, and where they are on, a Do Not Track or Global Privacy Control signal from your browser is honoured.

“Was this useful?”

Every tool asks that one question underneath it. Nothing is sent until you press Yes or No — the page stays silent while you use the tool. If you press No and tell us what you were trying to do, we keep the tool's name, the day, your answer and your words, and nothing else: no address, no session, nothing that says who you are. Please leave out the data you were working with; we don't need it, and if it turns up anyway we delete it.

Cookies

No tracking cookies and no advertising cookies. Your light/dark preference is kept in your browser's own local storage, which never leaves your device. If you use the contact form, Laravel sets a session cookie so the form can protect itself against cross-site request forgery; it expires on its own.

The contact form

What you type there is emailed to us and not stored in a database. We keep the email as long as we need it to reply, and no longer.

Third parties

The fonts and stylesheets this site uses are served from our own domain, so loading a page does not tell anyone else that you visited. There are no third-party embeds, social widgets or ad networks, and no third-party scripts anywhere except one: our pricing page loads Paddle's checkout, because Paddle take the payments. They are the merchant of record, so if you buy a plan you give your card details to Paddle and not to us — we never see a card number and store no payment details. What we keep is their customer id, which plan you are on, and whether it is active.

Questions

If something here is unclear or looks wrong, tell us — we would rather fix the wording than have you guess.