Privacy

The core promise

The content you put into a tool is processed by code running in your browser. It is not sent to a backend service in order to make the tool work. That covers pasted text, uploaded files, JSON, YAML and CSV input, tokens, ciphertext, passphrases, generated passwords and UUIDs, and PDF files together with the passwords used to unlock them.

What the promise does not mean

It does not mean the page makes no network requests at all. Like any website, this one serves HTML, JavaScript, CSS, fonts, and images, and your browser fetches them from the server. The boundary that matters is between serving the application and processing your payload — the first happens over the network, the second does not.

Analytics

This deployment uses Vercel Analytics and Speed Insights, which record aggregate page views and performance timings. They do not receive the contents of any tool input. No advertising trackers, no third-party ad scripts, and no cross-site profiling are used, and there is no account system, so nothing you do here is tied to an identity.

The PDF password remover

This one is worth calling out, because it is the category where hosted tools most often claim privacy they do not deliver. Most online PDF unlockers upload the document and its password to a server.

• Neither the PDF nor the password is ever sent over the network.
• The file is read in the page, handed to a Web Worker, and decrypted there by a WebAssembly build of qpdf.
• The worker is created per attempt and terminated as soon as it answers, releasing the memory holding your file.
• The result is a blob URL that is revoked when you clear the tool or leave the page.
• The qpdf engine is served from this origin, so no CDN sits in the path.

Once the page has loaded, unlocking works with no network connection at all — you can disconnect and try it.

Browser storage

Stored state is kept minimal: your light or dark theme preference, plus the browser's ordinary cache of the site's assets. Tool input is not persisted between visits.

Verifying any of this

You do not have to take it on trust. Open your browser's network panel and use any tool — you will see no request carrying your input. The source is public, and the site sends a strict Content Security Policy that confines network access to this origin. See the about page for the project background.