Privacy

Nothing you paste leaves your browser

Every tool on this site is JavaScript running in your tab. It reads what is already in memory there, transforms it, and writes the result back onto the page. There is no upload step because there is nothing to upload to. The site is static files on S3 behind CloudFront, and a static file cannot receive anything.

That covers the inputs people are right to worry about. Images dropped into the converters are read by a canvas in your own browser. The image-to-text tool downloads an OCR engine and runs it on your machine rather than posting your screenshot to an API. JSON, CSS, JavaScript and Python are handled by code in the page. So are JWTs, and that one matters most: a token pasted into a hosted decoder is a live credential handed to a stranger.

You don't have to take our word for any of this. Open your browser's network panel, use any tool on the site, and watch what goes out.

What does reach a server

Loading a page is still a network request, and a few features make their own. The complete list:

• The newsletter formThe signup box below each tool is an embedded Cognito Forms iframe, so Cognito serves it and sees that request. We get an email address only if you type one in and submit it. The form carries the name of the tool you were on, which is how we tell which pages people find useful. That is the whole of the measurement.
• Libraries fetched on first useA few tools need something too large to ship with the page: Prettier for the prettifiers, Terser for the JavaScript minifier, Less.js for the Less compiler, Tesseract for OCR, Pyodide for the Python playground, Monaco for the editors. These arrive from jsDelivr on first use, except Less.js, which comes from Cloudflare cdnjs. The CDN sees that a browser asked for a library. It can't see what you then paste into it.
• The typefacePage text is set in a font served by Google Fonts, so Google sees the request for the font file. Nothing about what you are doing travels with it.
• The promo cardThe card under each tool reads a small ads.json from this site's own CloudFront distribution. One file, byte-identical for every visitor, with no idea who asked for it.
• Web server logsCloudFront logs requests the way every web server does: IP address, user agent, path, timestamp. They are kept briefly for security and debugging, and are not analysed for individual behaviour.

What this site does not do

There is no analytics on this site. Not Google Analytics, not a privacy-friendly alternative, not a self-hosted counter. We genuinely don't know how many people used the JSON formatter today, and we'd rather not know than build the thing that would tell us.

No cookies, no tracking pixels, no advertising network, no accounts, no login. Your browser's local storage holds exactly two things: the theme you picked, and the recent swatches in the colour picker. Both stay on your machine. Neither is ever sent anywhere.