1. Design philosophy: offline-first
The tools on this site (Base64, JSON formatter, JWT decoder, hash calculator, image compressor, etc.) never send your input to a server. Everything runs entirely in browser-side JavaScript.
API keys, passwords, sensitive JSON, private images — whatever you enter never crosses the network. The goal is to let you verify this yourself with DevTools, not just ask you to trust us.
Works in airplane mode, poor signal, or restricted corporate networks — once opened, the tools work offline.
2. Service Worker caching
The entire site is built as a PWA (Progressive Web App) and uses a Service Worker to cache static assets. Pages visited once remain available offline.
HTML, CSS, JS, and images are stored in the Cache Storage API. Reloading the page reads from cache and produces no new network requests. Cache updates happen in the background on your next visit.
Check registration and cached items in DevTools → Application → Service Workers.
3. Content Security Policy (CSP)
connect-src 'self' prevents scripts from sending fetch, XHR, or WebSocket requests to external domains. Even if a malicious script were injected, it could not transmit user data to an outside server.
This is part of a defense-in-depth strategy: design and implementation limits data flow, and the HTTP header enforces it mechanically.
4. Web Crypto API for local processing
Hash calculations (SHA-256, SHA-384, SHA-512) and JWT verification use the Web Crypto API — a standard API built into the browser. No data needs to leave the device.
Base64 encode/decode, JSON parsing, regex — all run in client-side JavaScript.
5. Use of analytics and tracking
This site uses Google Analytics to understand site usage and improve content. Statistical data such as page views and time spent on the site are collected, but this does not include information that directly identifies specific individuals.
Importantly, data entered into the tools (sensitive JSON, images, encryption keys, etc.) is never sent to Google Analytics. Tracking is strictly limited to measuring overall site navigation and usage.
6. Image processing is also local
Image compression, resizing, and WebP conversion are handled entirely in the browser using APIs like Canvas. Images are never uploaded to a server — only the converted result is shown and downloaded.
Safe to use with confidential images and private photos.
7. How to verify
Open DevTools (F12) → Network tab, then use any tool to input, convert, or copy. No new network requests will appear (except on the initial page load).
Enable airplane mode — tools you already have open will continue to work.
Last updated: February 2026