Where your data goes

// what each tool sends, what the server keeps, and how to check it yourself

The short version

  • LOCAL 16 tools. What you paste is processed in this browser tab. It is never sent, logged or stored, and each page's security policy tells your browser to block any attempt to send it.
  • SHARED · 1H Code Share and Pen. Nothing is uploaded until you create a link. Then what you share is stored on our server and deleted one hour after the last edit.
  • ALL No accounts, no cookies, no analytics, and no third-party requests. Fonts and scripts are served from devtoken.tools itself.

LOCAL tools

When you open a tool, your browser downloads its page, styles and scripts from devtoken.tools. From then on everything happens in JavaScript in your tab, using standard browser features such as Web Crypto for hashing, signatures and random values.

  • Nothing is saved. The tools don't write your input to cookies, local storage or anywhere else. Close the tab and it's gone.
  • Handoffs between tools stay in the browser. When one tool passes data to another (for example, the Header Analyzer sending your Set-Cookie lines to the Cookie Analyzer), the data travels in the part of the link after #. Browsers never send that part to a server. The receiving page reads it and removes it from the address bar straight away, but it can still appear in your browser history. That's why the AWS tools only ever hand over an access key ID, never a signed URL or a secret.
  • Samples are generated in your browser. Sample keys, tokens and certificates are created on the spot. None are real, and none are shared between visitors.

Enforced by your browser, not just promised

Every page on devtoken.tools except Code Share and Pen is served with this Content-Security-Policy header:

default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; connect-src 'none'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'self'
connect-src 'none'
The page can't open a network connection from script: no fetch, XMLHttpRequest, WebSocket, EventSource or sendBeacon, to any server, including ours. If code on the page tried, the browser would block it and log a CSP error in the console.
script-src 'self'
Only script files from devtoken.tools run. There are no inline scripts and no third-party scripts, so nothing can be slipped in to change the rule above.
form-action 'none'
The pages can't submit a form anywhere.

What the policy doesn't cover. A page can still load its own files (styles, scripts, fonts, images) from devtoken.tools. That's how any web page works, and it's how a malicious page could still leak data to its own server, for example inside an image address. So don't take the header alone as proof. The Network tab check below shows that every request happens when the page loads, and none happen when you use a tool.

SHARED tools: Code Share and Pen

These are the only two features with a server side. Nothing is sent until you create a link.

What is sent
Code Share: file names, languages and contents (up to 8 files). Pen: your HTML, CSS and JavaScript. After that, each edit is saved to the same link.
Password (Code Share)
If you set a password, your files are encrypted in your browser with AES-256-GCM, using a key derived from the password with PBKDF2-SHA256 (600,000 rounds). The server stores only the encrypted data, the salt, and a hash of a separate access key. It never sees your password or your code, so a lost password can't be recovered. Pens are not encrypted.
How long it's kept
Deleted one hour after the last edit. A cleanup job runs every 15 minutes, so allow up to an hour and a quarter.
Who can see it
Anyone who has the link, until it expires. Treat the link like the content. Shared pages ask search engines not to index them.
Your IP address
Stored with each link creation and save, to enforce rate limits (20 new links and 240 saves an hour), and with each wrong Code Share password, to slow down guessing. These records are deleted after an hour.
Running pens
Pens run in a sandboxed frame that can't reach this site's pages, cookies or storage. A shared pen doesn't run until you press Run, and it can only send requests to devtoken.tools, never to other sites.

What any web server sees

Like every website, our hosting provider's web server logs each request: IP address, time, the page or file requested, and your browser's user agent. These logs can't contain what you paste into a LOCAL tool, because it is never sent, or anything after # in a link, because browsers don't send that part either.

Check it yourself

  1. Open a LOCAL tool, for example the JWT Decoder.
  2. Open DevTools (F12, or Cmd+Option+I on a Mac), go to the Network tab, and clear it.
  3. Paste something, or load a sample, and run the tool.
  4. The Network list stays empty. The Console tab stays free of CSP errors.

To see the policy header from a terminal:

curl -sI https://devtoken.tools/jwt-decoder.html | grep -i content-security-policy

Every script is a plain, readable file. View the page source, or open one directly, such as /jwt-decoder.js or /jose.js.

What no website can protect you from

  • Browser extensions with access to all sites can read any page, including this one. For real secrets, use a browser profile or private window with extensions turned off.
  • Your clipboard and history stay on your device after you close the tab.
  • If you've pasted a live secret somewhere you're not sure about, rotate it. That's the only fix that always works.

Questions or a request that shouldn't be there?

Email hello@devtoken.tools. If you ever see a LOCAL tool make a network request after the page has loaded, that's a bug, and we'd like to hear about it.