You paste a chunk of text — maybe an API response, a token, a config file — into a free online tool and click a button. It formats or converts it perfectly. But what just happened to that text?
A lot of tools send it to a server
Many online formatters, encoders and validators post whatever you paste to their backend to do the work. For a shopping list that's harmless. For a JWT, an API key, a database dump or a config with secrets, it means your sensitive data just landed on someone else's server, where it might be logged.
Developers paste sensitive strings into these tools all day without thinking about it. That's exactly how secrets leak.
In-browser tools never send it
Every tool on AXS TXT runs entirely in your browser with JavaScript. Your text is processed on your own machine and never leaves it. That's why you can safely:
- Decode a JWT to inspect its claims.
- Format JSON that contains real data.
- Hash or Base64 a value.
How to check any tool
Open your browser's network tab and use the tool. If no request fires when you process the text, it's local. If it does, your data is leaving. When in doubt, assume a tool uploads — and keep secrets in tools that don't. Read more on our security page.