What you paste stays in your browser.

Every tool here, from the JSON and JWT tools to the time, key and code tools, is JavaScript running in your tab, using code that came with the page. Nothing you paste is uploaded or logged, and it doesn't turn up in error reports either. You can check this in your browser's network tab: what you paste never appears in a request. The requests the page does make are listed under "Third parties" below, and none of them carry anything you type.

Once a page has loaded, its tool keeps working if you go offline. Two parts are fetched from ToolJar itself the first time you use them: the minifier behind Minify in the JavaScript Formatter, and the tokenizer the Token Counter loads once you edit the text.

JWT signatures are computed with your browser's built-in WebCrypto. Tokens and secrets are held in memory while the tab is open and are never written to storage, so a secret you type is gone when you close the tab. The Prompt Secret Scrubber keeps its list of placeholders and the values they stand for the same way.

ToolJar itself stores one thing: whether you picked the light or dark theme, kept in localStorage so it survives a reload. What you paste, your searches, and your tokens and secrets are never stored, and are gone when you close the tab.

Cloudflare, which hosts the site, also sets one cookie, cf_clearance, which records that your browser passed its automated bot check. It is marked HttpOnly, so ToolJar's own code cannot read it, and it is only ever sent back to this site.

You can remove both by clearing your browser's site data for tooljar.in. The theme on its own can be cleared by running localStorage.clear() in your browser's developer tools on this site.

One company: Cloudflare, which hosts the site. Besides the access logs every web host keeps, two of its scripts run on each page:

• Cloudflare Web Analytics, which counts visits. It records the page viewed, the referring site, the browser, the country and how fast the page loaded. It sets no cookie and doesn't follow you across sites.
• Cloudflare's bot protection, which checks that a visitor is a browser and not an automated script. It sends Cloudflare technical signals about the browser and sets the cf_clearance cookie described above.

Neither of them sees anything you paste or type into a tool. There are no ads and no other trackers, and the fonts are bundled with the site, so no font service sees your IP address either.

The WhatsApp, X and LinkedIn share buttons are plain links. Nothing is sent to those services unless you click one, and then it opens their own share page with the page's public address and a short sentence naming the tool. Nothing you typed into a tool, and nothing from the address bar, goes with it, and you choose whether to post.

If something like a "recent documents" list is ever added, it will be opt-in, clearly labelled and easy to wipe. The same applies to any new tool: if a feature ever needed to send your data anywhere, this page would say so first, in plain words.