Check it yourself

Watch the network tab

This is the test that matters. Your browser keeps a list of every request a page makes, and you can watch it.

1. Open a tool, for example the JSON formatter.
2. Press F12 to open developer tools. On a Mac, press ⌘ ⌥ I. Click the Network tab.
3. Tick Preserve log. Click the clear button, the circle with a line through it.
4. Paste something into the tool. A made-up secret such as sk_test_not_a_real_key is a good test.
5. Watch the list. It stays empty. Nothing is sent while you type, paste or press a button.

If you reload the page, the list fills with the page, its stylesheet, its scripts and its fonts. All of them come from this site. Nothing comes from anywhere else.

Read the policy that enforces it

Every page comes with a Content-Security-Policy header. Your browser enforces it, not us: code on the page cannot do what the policy forbids. This is the header exactly as the server sends it.

default-src 'none';
script-src 'self';
style-src 'self';
style-src-attr 'unsafe-inline';
img-src 'self' data:;
font-src 'self';
connect-src 'none';
worker-src 'self';
manifest-src 'self';
base-uri 'none';
form-action 'none';
frame-ancestors 'none';
object-src 'none'

The other headers (no frames, no sniffing, HTTPS only) are in the same place. Click any request in the network tab and open Headers to read them all.

Count the requests on this page

This box counts the requests this page has made, using a number your browser keeps. Type or paste below. It is a small Base64 encoder, and the count should not move.

This is the page reporting on itself, so treat it as a demo. The network tab above is outside our code. A request the policy blocks never appears in the browser's list, which is why the button shows the block directly: it tries to send your text to an address that does not exist, and the browser refuses.

Switch it off

1. Load a tool page and wait until it has finished.
2. Turn off Wi-Fi, or in the Network tab choose Offline from the throttling menu.
3. Use the tool. It still works.

This shows the tool needs no server to do its job. It does not show that nothing was attempted. For something truly sensitive, load the page, go offline, then paste. Nothing can leave a machine that is offline.

Look at the code

Open view-source on any page, or the Sources tab. Every script is a file from this site. There are no inline scripts and no scripts from other sites. The only script tag with content holds search-engine data (application/ld+json), which your browser does not run. The scripts are plain files you can read.

See what is stored

In developer tools open the Application tab (Storage in Firefox).

1. Cookies: the list for this site is empty. There are no accounts and no analytics.
2. Local storage: keys that start with ws-. They hold your light or dark choice and whether you enlarged a pane.
3. Session storage: the Try-it buttons on error pages keep an example text here for the next page, then remove it.

What this does not prove

• Cloudflare serves this site. As with any website, the host sees the request for the page, including your IP address. It sees that request, not what you type.
• We could ship different code tomorrow. That is why these checks are yours to repeat: the policy and the scripts come with every visit, so you can look again whenever you like.
• The policy cannot stop everything. A script could still send the tab to another address, and browsers treat WebRTC separately. The tools use neither, and our test suite fails if a script uses one.
• The counter above is the page reporting on itself. The network tab is the check.
• The source code is not published, so you cannot read a tool before it runs. You can read everything your browser receives.
• The Bluesky, X and Buy Me a Coffee links in the footer are plain links. Nothing loads from them until you click.