Security & how your input is handled

How your input is handled

Every tool runs entirely in your browser. There is no server API that could receive what you type
Your input is never stored — neither on servers nor in browser storage
No third-party JavaScript, no analytics, no ad tags
A Content-Security-Policy also blocks outbound requests from the page at the browser level (connect-src 'none')
Automated tests continuously verify that a dummy secret string never appears in network traffic or storage

As with any website, ordinary access metadata (IP address, User-Agent, access time, URL) may be recorded by the web server. The contents of the input fields are not part of it
Some risks are beyond this site's control: a compromised device or browser extension, or clipboard contents being read by other apps (clipboard-history tools, etc.)
Your browser's own tab/form restore features may restore input field values on your device
Each tool has its own limitations (the Secret Masker can miss values; the JWT Viewer does not verify signatures; etc.)
No web tool can guarantee complete safety. For critical use cases, consider official tools and dedicated apps