Security & Data Handling

DevUtilsNow is private by design. Every tool on this site does its work entirely inside your browser, on your own device. This page explains exactly what that means — and, just as importantly, what it does not mean.

Everything runs client-side

When you paste JSON, a token, or any other input into a tool, it is processed by JavaScript running in your browser tab. Your input is not sent to our servers, because there is nothing to send it to — the site is served as plain static files with no application backend, database, or API that receives tool input.

• No transmission — your input never travels across the network to us.
• No server storage — we cannot store what we never receive.
• No login — there are no accounts, so there is nothing to link your usage to.

You can verify this yourself: open your browser's developer tools, switch to the Network tab, and use any tool. You will see no request carrying your input.

Each page also carries a Content-Security-Policy, visible in its source, that tells your browser to block requests to anywhere except this site and Google Analytics. One exception: in the Markdown previewer, images in your document load from the web addresses you give them, so those hosts see a normal image request. Your text is not sent to them.

On-device convenience storage

A few tools can remember your most recent input so it is still there when you return. When they do, it is saved only in your own browser using local storage on your device — it is never transmitted, and other sites cannot read it. Use a tool's Clear button, or clear your browser data, to remove it.

What these tools are — and are not

Being precise matters more than sounding secure:

• Encoding is not encryption. Base64, URL encoding, and similar transforms make data portable, not secret. Anyone can decode Base64 — it provides no confidentiality. Never treat encoded data as protected data.
• Hashing is one-way, not reversible encryption. A hash (MD5, SHA-256, …) is a fingerprint of your input. It is not "encrypted" and cannot be decrypted back to the original.
• Decoding a JWT is not verifying it. Our JWT decoder reads the header and payload, which are only Base64URL-encoded. It checks the signature only if you provide a secret or public key. Without that check, a decoded JWT tells you what a token claims, not whether it is trustworthy.
• Formatting and validating check structure, not meaning. A tool confirming your JSON is valid is not confirming it is correct for your use.

Analytics

We use Google Analytics 4 to understand which tools are useful. This records usage data — such as which tool page was visited — and never the content you type or paste. See the Privacy Policy for details.

Reporting a concern

Found something that doesn't match this page, or a potential security issue? Please contact us — we want to know.