Every tool on this site runs as JavaScript inside your browser tab. When you paste JSON into the formatter and press Format, the sequence is: your paste lands in a textarea, JSON.parse runs on your CPU, JSON.stringify produces the output, and the result is written into the page. No step involves a network request. The same holds for decoding a JWT (Base64URL + JSON parsing), hashing (the browser's Web Crypto API) and every other tool here.
What runs where
The server's only job is delivering the pages, the same static assets to every visitor. Your data enters the picture only after the page is already in your tab, and it never leaves: there is no upload endpoint, no “share” feature, no analytics event carrying your input. Processing uses standard browser APIs, JSON.parse, crypto.subtle.digest, crypto.randomUUID, DOMParser, TextEncoder, plus a few bundled libraries (YAML, diff, cron parsing) that were downloaded as part of the page itself.
A check you can repeat on any tool
Follow the 10-second check above after the tool has loaded. Run a sample once, clear Network with All selected and no filters, then repeat the operation. Disconnect and change the sample to confirm that the loaded tool still computes a new result.
Initial HTML, script and font downloads are expected. Clearing Network separates those downloads from tool use. Offline operation applies to the page you already loaded; a reload or another tool can require a connection. The site does not install a service worker or promise that every page is cached for offline visits.
For code inspection, download the bundle manifest. Each build publishes SHA-256 checksums for its HTML and browser assets. A hash identifies bytes; it does not establish that code is safe or replace an independent review.
What that means for secrets and tokens
Data that never crosses the network cannot be logged, retained, breached, sold or subpoenaed from a provider, there is no provider copy. That is the difference between a policy (“we delete uploads after an hour”) and an architecture (“there is no upload”). It is why pasting a bearer token, a customer data export or a production payload here is categorically different from pasting it into an upload-based site, and why the browser vs server comparison is worth two minutes of your time.
The honest limits
Local processing is bounded by your device: a multi-hundred-megabyte file belongs in jq or an editor, not any browser tab. Jobs that genuinely need server compute video, OCR, large PDFs, are jobs this site deliberately does not offer. And local processing protects data in transit to us, not from your own machine: your clipboard history and browser extensions are still yours to manage. Measured figures for minify savings, Base64 overhead and hash lengths are on the stats page.