The promise
Every tool in this toolkit runs entirely inside your browser. The JSON, CSV, XML, or YAML you paste or drop never travels to a server to be processed — there is no server doing the work. Conversion, formatting, and validation happen on your own machine, in a Web Worker when the file is large, and the result is handed back to you to copy or download.
That isn't a privacy policy written after the fact. It's the shape of the code: there is no backend endpoint for your content to be sent to, because none was ever built. The trust you place in this site is trust in your own browser, not in our infrastructure.
Live proof
Don't take the promise on faith — watch it. The panel below instruments this very page. The moment it loaded, it wrapped the browser's fetch and XMLHttpRequestand started counting every outbound call the page's own code makes. Try it: paste something into a tool, convert it, format it. The number stays at zero, because none of that touches the network.
Open DevTools → Network, filter to Fetch/XHR, then convert a file. Watch the list stay empty. For 0s, this page has sent nothing that contains your data.
Scope: this counts fetch/XHR the page's JavaScript issues after load. It deliberately can't see the page's own initial assets (same-origin HTML/CSS/fonts) or browser/extension traffic — it measures what this code sends, which is the part that would carry your input.
Where your data goes
A line-by-line ledger of every place your input touches — and the answer to the only question that matters.
| Your data | Touches | Leaves your machine? |
|---|---|---|
| Text you paste | In-memory JavaScript + a Web Worker | No |
| A file you drop | Read locally via the FileReader API | No |
| The converted result | In-memory, until you copy or download it | No |
| Stars & recent tools | Your browser's localStorage | No |
There is no account, no session, and no server-side copy of anything you process. Close the tab and the in-memory data is gone; the only thing that persists is the small set of favorites and recents you chose to keep, stored on your own device.
How it's built
The promise holds because the architecture has no seam where your data could leak. Each tool is a thin page wired to a pure transform that runs off the main thread:
Editor
A plain textarea + line gutter. Your input lives only here, in the DOM.
Workspace
Layout + options. No data leaves the page; controls only set local state.
Store
In-memory state. No persistence, no network — just the current values.
Worker
Heavy parsing runs on a background thread so the UI never freezes.
Engine
A pure function: input + options in, result out. No DOM, no fetch, no side effects.
On top of that, a single registry drives the whole site, so the catalog, the footer, the search, and the SEO metadata can never disagree about what exists:
registry.ts
One typed list of every tool — id, name, category, status, keywords.
Catalog · Footer · Search · JSON-LD
All generated from the registry. Ship a tool once; every surface updates.
The guarantees
Every tool that ships must satisfy all of these, or it doesn't ship:
- Runs completely in the browser — no server-side processing of your content.
- No login, no account, no API key required to use any tool.
- No uploads — your input is never transmitted to be processed.
- No server-side storage of anything you paste or drop.
- Instant-loading shell; large work is deferred to a background worker.
- Mobile-friendly and keyboard-first, with copy/paste as the primary flow.
- Open source and built in the open — you can read every line that touches your data.
What we do send
Trust is earned by disclosure, so here is the complete list of network activity this site performs — none of which carries your pasted content.
| What | When | Why | Contains your data? |
|---|---|---|---|
| App HTML / CSS / JS / fonts | On page load | To render the toolkit itself | No |
| Anonymized pageview (Google Analytics) | On load, in production only | To understand which tools are used | No |
The analytics ping sees only the page URL and standard browser metadata — never the contents of an editor, a file, or a result. It is disabled entirely in local development. If you'd rather block it, your browser's tracking protection or an extension will stop it without affecting any tool.
The short version: your data stays on your machine, the code that proves it is public, and the only thing we measure is which pages get visited — not what you do on them.