Security & Data Handling

DevUtilsNow is private by design. Every tool on this site does its work entirely inside your browser, on your own device. This page explains exactly what that means — and, just as importantly, what it does not mean.

Everything runs client-side

When you paste JSON, a token, or any other input into a tool, it is processed by JavaScript running in your browser tab. Your input is not sent to our servers, because there is nothing to send it to — the site is served as plain static files with no application backend, database, or API that receives your data.

• No transmission — your input never travels across the network to us.
• No server storage — we cannot store what we never receive.
• No login — there are no accounts, so there is nothing to link your usage to.

You can verify this yourself: open your browser's developer tools, switch to the Network tab, and use any tool. You will see no request carrying your input.

On-device convenience storage

A few tools can remember your most recent input so it is still there when you return. When they do, it is saved only in your own browser using local storage on your device — it is never transmitted, and other sites cannot read it. Use a tool's Clear button, or clear your browser data, to remove it.

What these tools are — and are not

Being precise matters more than sounding secure:

• Encoding is not encryption. Base64, URL encoding, and similar transforms make data portable, not secret. Anyone can decode Base64 — it provides no confidentiality. Never treat encoded data as protected data.
• Hashing is one-way, not reversible encryption. A hash (MD5, SHA-256, …) is a fingerprint of your input. It is not "encrypted" and cannot be decrypted back to the original.
• Decoding a JWT is not verifying it. Our JWT decoder reads the header and payload, which are only Base64URL-encoded — it does not check the signature. A decoded JWT tells you what a token claims, not whether it is trustworthy.
• Formatting and validating check structure, not meaning. A tool confirming your JSON is valid is not confirming it is correct for your use.

Analytics

We use privacy-respecting analytics (Google Analytics 4) to understand which tools are useful. This records anonymous usage events only — such as which tool page was visited — and never the content you type or paste. See the Privacy Policy for details.

Reporting a concern

Found something that doesn't match this page, or a potential security issue? Please contact us — we want to know.