Do online tools leak your data?
Developers paste sensitive things into online tools every day: debug JWTs, API responses containing keys, internal Nginx configs. Few stop to ask: where does that data actually go?
Two kinds of tools, fundamentally different
Server-side tools send your input over HTTP to someone else's server, process it there, and return the result. Your data has passed through someone else's machine — whether it gets logged, how long it's kept, and what it's used for is entirely up to them. A disclosure alone does not establish that processing is lawful or suitable for your data.
Local tools (like this site) ship their logic as JavaScript that runs inside your own browser. The data never leaves your device.
The 30-second test
You can verify any online tool like this:
- Press F12 to open DevTools, switch to the Network tab;
- Enable "Preserve log" and filter by XHR/Fetch;
- Paste content into the tool and hit the action button;
- Inspect whether the payload contains your synthetic input. A request alone does not prove input was uploaded, and an XHR/Fetch filter does not cover every transmission mechanism.
Practical advice
- For anything involving keys, tokens or customer data, prefer local tools or the command line;
- If you must use a server-side tool, sanitize first (replace real values with placeholders);
- Never paste internal configs or production logs into any online service;
- When in doubt, run the 30-second test above.
All 65 tools on ToolBox are strictly local. Feel free to run this test on every one of them.