Privacy
DevToolbox has no backend. 83 of the 90 tools are JavaScript that runs in your browser, so the code, tokens, logs and data you paste are processed on your own machine and are never transmitted to us, because there is nowhere for them to be transmitted to. The seven exceptions are listed below, and each one says on its own page what it sends.
For every tool except the seven network ones, input is read by client-side JavaScript and never sent anywhere. You can verify this: open your browser's network tab, use the tool, and watch that no request is made once the page has loaded.
Your theme, contrast setting, language, pinned tools, open workspace tabs and run history are kept in this browser's localStorage. Nothing syncs, nothing is backed up, and clearing site data removes all of it.
There are no accounts, no sign-in, no tracking cookies, no advertising network and no third-party scripts that read what you type. Share links carry the input in the URL fragment, which browsers never send to a server.
What is collected
Nothing you enter into a tool. No name, email address, form submission, file or clipboard content is collected, logged or retained.
Two aggregate measurement services run on the site, and they are the only scripts that talk to anything:
- Vercel Web Analytics gives anonymised page-view counts. It sets no cookies and builds no cross-site profile.
- Vercel Speed Insights gives Core Web Vitals measurements (load time, responsiveness, layout stability) sampled from real visits.
Both report on pages, not people. Neither has access to tool input, because tool input never leaves the page.
The seven tools that do use the network
A handful of tools cannot answer their question without asking something else. They are the only places on the site where anything you type leaves your browser, and none of it passes through DevToolbox. The request goes straight from your machine:
- DNS Lookup: sends the domain name you look up to dns.google, Google Public DNS over HTTPS.
- SSL Checker: sends the hostname you check to corsproxy.io and then api.ssllabs.com, the Qualys SSL Labs service.
- What Is My IP: sends a request from your connection to ipapi.co.
- SVG Extractor: sends the page address you enter to that page, and a CORS proxy when the site refuses a direct request.
- API Tester: sends the request you compose: URL, headers and body to whatever address you point it at.
- Request Tester: sends the request you compose: URL, headers and body to whatever address you point it at.
- Socket Client: sends the messages you type to the WebSocket endpoint you connect to.
Three of them involve a third party by necessity: DNS resolution needs a resolver, a certificate report needs an authority that has seen the certificate, and your public address can only be reported by a machine outside your network. Their privacy policies are their own.
Storage on your device
The site writes a small number of localStorage keys, all of them preferences you set yourself:
devtoolbox-themeanddevtoolbox-contrasthold your appearance choices.devtoolbox-workspace-v1holds which tools you have open, and your recent runs.- Pinned tools and your chosen interface language.
No cookies are set by DevToolbox. Removing this site's data in your browser settings clears everything above.
Third parties
Fonts
Geist and Geist Mono are self-hosted. They are downloaded at build time and served from this domain, so your browser makes no request to Google Fonts and no font provider sees your IP address.
Hosting
The site is hosted on Vercel. As with any web host, Vercel processes standard request data (IP address, user agent and timestamp) in the course of serving the page. DevToolbox does not configure, read or retain those logs.
Everything else
There are no advertising networks, no A/B testing platforms, no session recorders, no chat widgets and no CDNs beyond the host itself.
Sharing a tool's state
The share button produces a link of the form devtoolbox.cloud/json-formatter#s=…, where the fragment after # is your input, base64-encoded. Browsers do not send the fragment as part of the HTTP request, so opening a share link transmits the path but never the data. The recipient's browser decodes it locally.
That also means a share link is only as private as wherever you paste it. Treat it like the content itself.
Offline use
Once a tool page has loaded, it needs no further network access to work, with the obvious exception of the seven network tools above, which need a connection by definition. Losing your connection mid-task does not interrupt anything else.
Children
The site is a set of developer utilities and is not directed at children. Since no personal information is collected from anyone, none is collected from children either.
Changes
Any change to this page will carry a new effective date. Because there are no accounts and no email addresses, there is no way to notify you directly. The date at the top is the record.
Contact
Questions about this page, or a correction to it, go to info@devtoolbox.cloud. If you have found a security problem, such as a tool that leaks input or a script that executes something it should not, report it to security@devtoolbox.cloud and it will be treated as the priority it is.