Privacy Policy
This policy explains what happens to data when you use DevToolChain. The tools process what you enter in your browser. The site has no accounts and no sign-up.
Last updated: October 4, 2026
Summary
- You cannot create an account, and the site does not ask for your name or email address.
- Text, tokens and files that you give to a tool are processed in your browser. They are not sent to us or to anyone else.
- Your input is stored on your device only if you turn on “Remember my input on this device”. Your appearance preference is stored on your device as well.
- The hosting provider processes technical request data to deliver the pages.
- The site currently shows no advertisements and loads no advertising code.
What the tools do with your input
Every tool on DevToolChain is a program that runs inside the page in your browser. What you type or paste is read, processed and displayed there. The tools make no network request with your input, and no part of the site receives it.
When you choose a file in the Base64 tool, the hash generator or the certificate decoder, your browser hands the file to the page. The page reads it into memory, processes it and discards it when you leave or reload the page. The file is not uploaded. When the Base64 tool previews a decoded image or opens a decoded PDF, it does so from a temporary blob: address that exists only inside your browser.
The regular expression tester runs your expression in a background thread of the same page. The thread is part of your browser and sends nothing.
“Copy result” writes the result to the clipboard of your device. “Download result” saves a file that the page creates on your device. The JWT decoder and the Unix timestamp converter read the clock and the time zone of your device, the UUID generator reads the clock for version 7, and the certificate generator reads the clock for the start of validity. The cron tool reads the clock and time zone of your device for the next run times, and the certificate decoder reads the clock to show whether a certificate has expired. Some tools load more of their own code from this site the first time you use them, such as the YAML converter; that request carries none of your input. The secret or key that you enter in the JWT decoder or the HMAC generator is never stored, and the private key of a generated certificate or CSR exists only in the page, in the files you download and on your clipboard if you copy it. The HMAC generator reads the clock of your device to check the age of a webhook timestamp, and the UUID generator reads it for ULIDs as well.
Data stored in your browser
The site uses the local storage of your browser. It sets no cookies of its own.
| Name | Content | When it is stored |
|---|---|---|
| web-theme | Your choice of the light, dark or system appearance. | When you change the appearance at the bottom of a page. |
| dev-tools: followed by the name of a tool, for example dev-tools:json-formatter | The content of the input fields and the selected options of that tool, as unencrypted text. Chosen files, results and the secret of the JWT decoder are not stored. | Only while “Remember my input on this device” is turned on for that tool. Turning it off deletes the entry. |
The option to remember input is off until you turn it on, separately for each tool. Think twice before you turn it on for secrets such as access tokens: other people who use the same browser profile, and software that can read the data of your browser, can read the stored text.
This data stays on your device and is not sent to us. You can delete it at any time by turning the option off or by clearing the site data in your browser settings.
Hosting and request data
The site is delivered by Cloudflare, our hosting provider. When your browser requests a page, Cloudflare processes technical data that is needed to deliver the page and to protect the service, such as your IP address, the requested address, the time of the request and information about your browser.
We do not keep our own database of visitors.
Advertising
The site currently shows no advertisements. Its pages contain no advertising code and make no requests to advertising providers or consent tools.
If we start to show advertisements, we will update this policy before they appear, including which provider is used, which data it receives and how you can make choices. Even then, the JWT decoder, the HMAC generator, the self-signed certificate generator, the CSR generator and the certificate decoder will show no advertisements, because you may enter secrets, private keys or certificates there.
Authorized sellers (ads.txt)
The file /ads.txt on this site names Google, under our publisher account, as the only company that would be authorized to sell advertising space on this site. It is published in preparation for advertising and contains no data about visitors.
Your choices
- Leave “Remember my input on this device” turned off, or turn it off again, to keep nothing of your input on the device.
- Clear the site data in your browser to remove the stored preference and tool data.
- Write to us if you have a question about this policy.
Changes to this policy
We update this page when the way the site handles data changes. The date at the top of the page shows the latest revision.