Questions
Frequently asked
How DevToolery works, what it keeps, and where it stops being reliable.
- Is my data really not uploaded?
- Yes, and you can check it rather than take our word for it. Open your browser's network panel, paste something into any tool, and watch the request list. Nothing appears, because the JavaScript doing the work is running on your machine. There is no backend to receive it.
- Do I need an account?
- No. There is nothing to sign up for. Favourites and saved snippets are kept in your browser's own storage, which is why they do not follow you to another device.
- Why is it free?
- Because your usage costs us almost nothing. No server processes your data, so there is no per-request cost to recover. Serving static files from a CDN is cheap and does not get more expensive when your file is bigger.
- Does the JWT decoder verify signatures?
- No, and no browser tool honestly can. Verifying a signature requires the issuer's secret or public key. Decoding only reveals what the token claims about itself — anyone can craft a token whose payload says whatever they like.
- Does it work offline?
- Once you have loaded a page, the tool on it keeps working with the network disconnected, because the code is already in your browser. Install it as a PWA to keep the whole app available offline.
- How large a file can it handle?
- It depends on your device's memory rather than on a limit we impose. A few megabytes of text is comfortable on most machines. Past that, tools warn you before working — a browser tab has less headroom than a server process, which is the honest trade-off for keeping your data local.
- Are the generated API keys real?
- No. They are random strings shaped like the keys various services issue. They are not registered anywhere and grant access to nothing. Use them for fixtures and mockups.
- Can I use this at work, on customer data?
- That is exactly what it is for, and it is why the tools run locally. Your own organisation's policy still applies, and the security page describes the specific protections if you need to point someone at them.
- Why does the domain parser say “approximate”?
- Splitting a hostname into subdomain, domain and public suffix correctly requires the full Public Suffix List, which is large and changes regularly. We use a short built-in list of common suffixes and label the result as a guess rather than pretending to be authoritative.
- Something is wrong. Where do I report it?
- The contact page. Please include a small example that reproduces the problem — and never send real credentials or customer data in a bug report.