Privacy

The core promise

The content you put into a tool is processed by code running in your browser. It is not sent to a backend service in order to make the tool work. That covers pasted text, uploaded files, JSON, YAML and CSV input, tokens, ciphertext, passphrases, generated passwords and UUIDs, and PDF files together with the passwords used to unlock them.

What the promise does not mean

It does not mean the page makes no network requests at all. Like any website, this one serves HTML, JavaScript, CSS, fonts, and images, and your browser fetches them from the server. The boundary that matters is between serving the application and processing your payload — the first happens over the network, the second does not.

Analytics

Vercel Analytics and Speed Insights record page views and performance timings without cookies. Web Analytics uses a temporary hash derived from the request to distinguish visitors. These services run independently of your Google Analytics cookie preference. Tool input is not included in these measurements.

Google Analytics loads before you answer the banner. Before you allow analytics cookies, and when you decline, it sends limited page-view and engagement measurements without reading or writing analytics cookies. Requests can include page URLs, referrers, browser information and temporary values. Google receives your IP address when your browser connects.

Allowing analytics cookies lets Google recognise returning visits and connect activity across pages. Google can set _ga and _ga_ followed by the measurement stream ID. These cookies normally expire after two years, subject to browser limits and Google settings. Advertising features are disabled.

You can turn Analytics cookies off and save using Cookie preferences below or in the footer. This updates consent in other open tabs on this origin and removes existing GA cookies for this site. Cookieless Google and Vercel measurement continues. It does not reload the page or delete previously collected data.

Analytics does not receive what you put into a tool. Tool input is processed in your browser. Every tool also works if Google's script is blocked.

About cookie preferences

The PDF password remover

This one is worth calling out, because it is the category where hosted tools most often claim privacy they do not deliver. Most online PDF unlockers upload the document and its password to a server.

• Neither the PDF nor the password is ever sent over the network.
• The file is read in the page, handed to a Web Worker, and decrypted there by a WebAssembly build of qpdf.
• The worker is created per attempt and terminated as soon as it answers, releasing the memory holding your file.
• The result is a blob URL that is revoked when you clear the tool or leave the page.
• The qpdf engine is served from this origin, so no CDN sits in the path.

Once the page has loaded, unlocking works with no network connection at all — you can disconnect and try it.

Browser storage

Stored state is kept minimal: your light or dark theme preference, your cookie choice, the browser's ordinary cache of the site's assets, and — only if you accept analytics — Google Analytics' own cookies. Tool input is not persisted between visits.

Silktide stores preferences in localStorage under keys beginning stcm.supertools_consent., including a necessary-storage flag before you answer. Your analytics consent state is communicated to Google. Your choice is specific to this browser and site origin; clearing site storage resets it.

Verifying any of this

You do not have to take it on trust. Open your browser's network panel and use any tool — you will see no request carrying your input. The source is public, and the site sends a strict Content Security Policy that confines network access to this origin and, where analytics is enabled, to Google's measurement endpoints — nothing else. See the about page for the project background.