Learn
Why it is safe to paste a real secret here.
Developer tools are where secrets get pasted — an access token into a JWT decoder, a webhook signing key into an HMAC generator. Here is exactly what happens to them, mechanism by mechanism, so that claim is checkable rather than a promise.
Last updated 12 August 2026
What runs where
JSON is parsed by the browser's own built-in parser. Hashes and HMAC signatures come from WebCrypto's SubtleCrypto, the same cryptographic primitive every browser ships for its own use. Random UUIDs come from crypto.getRandomValues, a cryptographically secure source, not Math.random. Files given to the checksum tool are read from disk with the File API rather than uploaded anywhere to be hashed.
None of that needs a server, so none of it has one: every developer tool computes its result inside the tab you already have open, using APIs the browser already exposes to any page.
The regex tester's safety net
A regular expression can pathologically backtrack — a pattern that looks innocent can take exponentially longer to fail on a crafted input, long enough to freeze a tab. The regex tester runs every pattern inside a Web Worker with a timeout, so a catastrophic pattern is reported as such rather than hanging the page you are working in.
Pasting a real credential, honestly
"Never leaves the tab" is a statement about transmission, not about the token's own validity — a JWT or signing key you paste here is still a live credential for as long as it has not expired or been rotated, exactly as it would be anywhere else you looked at it.
- Prefer an expired token or a test key where you have the choice, so a mistake costs nothing.
- Rotate anything you have previously pasted into a tool whose behaviour you have not personally checked — that advice applies here too, not as an exception.
- You can verify the no-transmission claim in ten seconds: open your network inspector, run any tool, and watch that no request contains what you typed.
Other families