Your data never leaves your browser
Every Dev Tools ! utility runs entirely in JavaScript in your browser tab. No inputs are sent to any server. Ever.
Privacy Principles
No Tracking
We use minimal analytics (opt-out available). Your tool inputs are never logged, stored, or transmitted anywhere.
No Server-Side Processing
Every tool — Base64, JWT, Hash, Regex — runs entirely in your browser via JavaScript. Zero server round-trips for tool execution.
Open Source Philosophy
The full source is on GitHub. You can audit the code, verify our claims, fork it, or self-host it. No black boxes.
GDPR by Design
We collect no personal data through tool usage. Cookie consent is granular. We never sell data to third parties.
Security Checklist
Technical security measures implemented across the site. Where a control is only partly applied we say so and explain what is missing — a checklist you cannot verify is worth nothing.
- Content Security Policy on every response — default-src 'self', no unsafe-evalPARTIALscript-src and style-src still allow 'unsafe-inline'. The prerendered pages and the cookie-consent default state ship as inline <script>/<style>, and removing the allowance requires a per-response nonce, which static hosting on Cloudflare Pages cannot emit. Everything else is locked down: no 'unsafe-eval', base-uri and form-action pinned to 'self', and a script-src allow-list naming every third-party origin.
- No third-party script loads before you accept cookiesThe HTML we serve contains no analytics, Clarity or AdSense tag. Those are injected by JavaScript only after consent. Subresource Integrity is not applied to them — Google and Microsoft rotate those files without publishing hashes, so the CSP script-src allow-list is the control in force instead.
- HTTPS enforced everywhere via Cloudflare, with HSTS preload
- DOMPurify sanitization on all HTML rendering
- WebCrypto API for all cryptographic operations (never Math.random)
- No eval(), no dangerouslySetInnerHTML outside sanitized renderers
- Cloudflare Turnstile for bot protection on all forms
- Input validation via JSON Schema on all tool inputs
Response headers in force
Sent on every response from devtoolzy.com. Check them yourself with curl -sI https://devtoolzy.com.
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN (ALLOWALL on /embed/* only) |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=() |
| Cross-Origin-Resource-Policy | cross-origin |
| Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' <allow-listed origins>; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; worker-src 'self' blob:; base-uri 'self'; form-action 'self'; upgrade-insecure-requests |
Found something wrong with any of the above? /.well-known/security.txt is our RFC 9116 disclosure record — it carries the reporting address, the scope, and the expiry date of that record. You can also contact us directly.
Third-Party Services
We use a minimal set of trusted third-party services, listed here for full transparency.
Data Retention
We store nothing server-side from tool usage. LocalStorage is used only for your preferences (theme, language, calculator history) and stays on your device. You can clear it at any time from your browser settings. We have no ability to access it.
Our Commitments
Questions about our privacy or security practices?
Contact Us