Where your data goes when you use these tools
Almost every tool here runs entirely in your browser. Formatting JSON, decoding a JWT, hashing a string, generating a UUID or a password, converting between CSV, XML and YAML — all of it is JavaScript executing on your own machine. Nothing you paste is transmitted to us, which matters when the payload you are debugging contains a production token or a customer record.
Five tools cannot work that way, because they have to ask a remote server a question. DNS
Lookup queries Google Public DNS, IP Lookup uses ipapi.co, WHOIS Lookup goes to
rdap.org, the SSL Checker reads Certificate Transparency logs, and the HTTP
Header Checker falls back to a CORS proxy when a site blocks a direct read. Each of those
pages says so, and the Privacy Policy names every
endpoint. We would rather tell you than let you assume.
Written to be read, not just to rank
Every tool page carries a guide underneath it, and those guides are the point. The UUID
generator explains why version 7 usually beats version 4 as a primary key in MySQL, and why
storing a UUID as CHAR(36) spends 36 bytes to hold 16. The JWT decoder is blunt
that decoding a token proves nothing about it, and walks through the
alg:none and RS256-to-HS256 confusion attacks. The gradient generator explains
why blue-to-yellow turns muddy grey in the middle, and how interpolating in OKLCH fixes it.
The DNS page explains that "propagation" is a misnomer for cache expiry.
Where a tool has a limitation, the page states it. The AES tool tells you it uses a weak key derivation function and an unauthenticated cipher mode, and that you should not trust it with real secrets. The JSONPath evaluator admits it implements dot notation and array indexing rather than the full RFC 9535 grammar. That is more useful than a page insisting everything is fine.
If you find a mistake in any of it, tell me and I will fix it. Corrections get credited on the page.
Frequently Asked Questions
Is anything I paste into these tools sent to a server?
For all but five tools, no — they run as JavaScript in your browser and your input never leaves your device. The exceptions are DNS Lookup, IP Lookup, WHOIS Lookup, SSL Checker, and HTTP Header Checker, which must query a remote service to answer at all. Each names the service it contacts, and the Privacy Policy lists every endpoint.
Can I use the AES tool to encrypt something important?
No, and the page says so. It uses CryptoJS in passphrase mode, which derives the key with a single MD5 pass and encrypts with AES-CBC — a weak key derivation function and a mode with no tamper detection. It is a good way to see how symmetric encryption round-trips. It is not a vault. For real work use AES-GCM with a key derived by Argon2 or PBKDF2.
Are the generated UUIDs and passwords actually random?
Yes. The UUID, bulk UUID, password, and random string generators all draw from
crypto.getRandomValues(), your browser's cryptographically secure random
source, and the string generator uses rejection sampling so no character is favoured. The
Lorem Ipsum and random number tools use Math.random(), which is fine for
placeholder text but is not unpredictable — never use them for anything secret.
Who writes these pages?
Sumit Maurya, Founder and Head of Development at ThreeWorks, a digital agency in Navi Mumbai, India. The tools started as internal utilities for client work. More about how the pages are written.
I found a mistake in one of your guides. What now?
Please email it — corrections to the technical guides are the most welcome kind of mail, and they get credited on the page. Include the page and what you think is wrong.