What you paste stays in your browser.
Exactly what is stored, what is sent, and how to check that claim yourself.
Short version: what you paste stays in your browser. There's no server to receive it, so there's nothing to opt out of and nothing for anyone to leak.
How your data is processed
Every tool here — formatting, validation, the tree, diff, path lookup, conversion, statistics, and decoding, verifying and generating JWTs — is JavaScript running in your tab, using code bundled into the page itself. Nothing is uploaded, nothing is logged, and what you paste doesn't appear in error messages either. If you'd rather not take that on trust, open your browser's network tab: nothing you paste ever appears in a request. The only request the page makes is an anonymous visit count (see "Third parties" below), and disconnecting from the internet leaves every tool working.
JWT signatures are computed with your browser's built-in WebCrypto. Tokens and secrets are held in memory while the tab is open — they're never written to storage, so a secret you type is gone the moment you close the tab.
What is stored locally
Exactly one thing: whether you picked the light or dark theme, kept in localStorage so it survives a reload. Not what you paste, not your searches, not your tokens or secrets — close the tab and those are gone. No cookies, and nothing that follows you around the web.
You can clear the stored theme preference at any time by clearing your browser's site data for ToolJar, or by opening your browser's developer tools and running localStorage.clear() on this site.
Third parties
Just one: Cloudflare, which hosts the site. Besides the ordinary access logs every web host keeps, it counts visits with Cloudflare Web Analytics, a small script that records which page was viewed, the referring site, the browser, the country and how fast the page loaded. It sets no cookies, doesn't fingerprint your device or follow you across sites, and never sees anything you paste or type into a tool — that stays in your tab.
No ads, no trackers, and no third-party fonts either: the typefaces are bundled with the app rather than fetched from a font CDN, which would otherwise hand your IP address to someone else on every visit.
If this changes
If something like a "recent documents" list ever gets added, it'll be opt-in, obvious, and easy to wipe. The same goes for any tool added to the jar later: nothing here will quietly start sending your data somewhere, and if that ever became part of a feature it would be stated plainly, not buried on this page.