If nothing is uploaded, what does the site's server do?

It serves the pages themselves — the HTML, CSS and JavaScript. Once a tool page is loaded, the code that formats, decodes and hashes is already in your tab; your input never becomes part of any request.

Do the tools work offline?

Yes, once loaded. Open a tool, disconnect from the network, and it keeps working — the strongest possible demonstration that processing is local.

Is pasting a production JWT here really safe?

The token stays in your tab — you can watch the network stay silent while you decode. Still practice hygiene: a live token is a working credential, so prefer expired or test tokens when possible, on any tool.

How is this different from a privacy policy promise?

A policy says what a company will do with data it receives; local processing means the data is never received at all. There is nothing to log, retain, breach or subpoena. It is a property of the architecture, verifiable by you, not a promise.

How “nothing is uploaded” works

Every tool on this site runs as JavaScript inside your browser tab. When you paste JSON into the formatter and press Format, the sequence is: your paste lands in a textarea, JSON.parse runs on your CPU, JSON.stringify produces the output, and the result is written into the page. No step involves a network request. The same holds for decoding a JWT (Base64URL + JSON parsing), hashing (the browser's Web Crypto API) and every other tool here.

What runs where

The server's only job is delivering the pages — the same static assets to every visitor. Your data enters the picture only after the page is already in your tab, and it never leaves: there is no upload endpoint, no “share” feature, no analytics event carrying your input. Processing uses standard browser APIs — JSON.parse, crypto.subtle.digest, crypto.randomUUID, DOMParser, TextEncoder — plus a few bundled libraries (YAML, diff, cron parsing) that were downloaded as part of the page itself.

Verify it yourself in two minutes

Open any tool, say the Base64 encoder.
Open your browser's dev tools (F12 or Cmd/Ctrl+Shift+I) and select the Network tab.
Press the clear button so the list is empty.
Paste your data and run the tool.

The request list stays empty — no POST, no fetch, nothing containing your input. Compare that with an upload-based tool, where the same experiment shows your payload leaving in a request body:

# server-based tool, network tab:
POST /api/format HTTP/1.1
Content-Type: application/json

{"your": "entire document", "travels": "to their server"}

# this site, network tab, after pasting and formatting:
(no requests)

For the strictest version: load a tool page, switch your machine to airplane mode, and keep using it. Local tools do not notice.

What that means for secrets and tokens

Data that never crosses the network cannot be logged, retained, breached, sold or subpoenaed from a provider — there is no provider copy. That is the difference between a policy (“we delete uploads after an hour”) and an architecture (“there is no upload”). It is why pasting a bearer token, a customer data export or a production payload here is categorically different from pasting it into an upload-based site — and why the browser vs server comparison is worth two minutes of your time.

The honest limits

Local processing is bounded by your device: a multi-hundred-megabyte file belongs in jq or an editor, not any browser tab. Jobs that genuinely need server compute — video, OCR, large PDFs — are jobs this site deliberately does not offer. And local processing protects data in transit to us, not from your own machine: your clipboard history and browser extensions are still yours to manage.

How “nothing is uploaded” actually works