Skip to content
Toolwright

How privacy works

“Your data never leaves your device” is easy to say. This page explains how it is true, what the few exceptions are, and how to check for yourself.

The short version

  • Tools run in your browser. When you format JSON, merge PDFs or compress an image, the work is done by JavaScript on your device. Your text and files are not sent anywhere.
  • The browser enforces it. Our pages ship a Content Security Policy that only allows connections back to toolwright.com. A tool physically cannot send your input to another server.
  • No accounts and no tracking scripts. We don’t ask who you are, and there are no analytics, advertising or fingerprinting scripts on the site.
  • It’s open source. Everything described here is in the public repository, so you can read exactly what each tool does.

Verify it yourself in 60 seconds

  1. Open any tool, for example the JSON Formatter.
  2. Open your browser’s developer tools (F12, or Ctrl/Cmd + Shift + I) and switch to the Network tab. Clear it.
  3. Paste some data, drop a file, and use the tool. Watch the Network tab: no requests are made with your data.
  4. For a stronger test, switch your device to airplane mode after the page has loaded. Tools you have opened keep working, because nothing needed the network in the first place.

The Content Security Policy

Every response from this site includes a policy like the one below. connect-src 'self' is the important part: the browser refuses any attempt by page code to talk to a third party.

Content-Security-Policy:
  default-src 'self';
  connect-src 'self';
  img-src 'self' data: blob:;
  object-src 'none';
  frame-ancestors 'none'; …

What is stored on your device

These live only in your browser (localStorage). We never receive them.

  • Your theme choice (light, dark or system).
  • Your favorite tools and recently used tools.
  • A random anonymous code used by the tool request board (see below).
  • For some tools, your input and settings in the page address after the # so you can share a link. The part of a URL after # is never sent to a server.
  • Cached copies of the site’s own files, so tools work offline.

What does reach our server

Being honest about the exceptions matters more than a perfect-sounding slogan:

  • Loading the site. Like every website, the server that delivers our pages and scripts sees the request, and standard web-server logs may include your IP address and browser type. Tool input is not part of those requests.
  • The tool request board. If you suggest or vote for an idea, we store the idea text you wrote and a one-way SHA-256 hash of your anonymous browser code to count votes and limit spam. We do not store your email, name or IP address in that data.
  • Links you click. A few tools offer optional links to outside sites (for example, showing a photo’s coordinates on OpenStreetMap). Nothing is sent unless you click them.

Limits worth knowing

  • Your device is the boundary. If your computer or a browser extension is compromised, no website can protect you. Browser extensions can read page content.
  • Shared links contain your input. If you copy a share link, anyone who has it can see the data inside it. Share links are optional and only for you to send on purpose.
  • Cryptographic tools are conveniences, not vaults. The password generator uses your browser’s cryptographic random source, but you should still store passwords in a password manager.

Questions or concerns?

If you find something that doesn’t match this page, please open an issue. Privacy bugs are treated as top priority.