Developers and office workers paste things into online text tools all day: an API response to format, a token to decode, a customer list to de-duplicate, a config file to convert. Most of the time nothing bad happens. But what you paste goes wherever that tool sends it, and in 2025 a large part of it turned out to be public.
What happened with the "save" links
In November 2025 the security firm watchTowr published research on two long-running formatting sites, JSONFormatter and CodeBeautify. Both had a feature to save a snippet and get a shareable link. The links followed a predictable pattern, so they could be listed and downloaded by anyone. The researchers collected about 80,000 saved files and found Active Directory credentials, cloud and GitHub keys, private keys, CI/CD secrets and a bank's customer KYC data among them. They also found evidence that attackers were already scraping the sites for secrets. The save feature was switched off afterwards, but the lesson stands: a tool that keeps your text somewhere can lose it.
Three ways a tool can handle your text
- Processed in your browser. The page contains the code; your text is transformed on your device and never sent. Nothing to log, keep or leak.
- Sent to a server and discarded. The server does the work and returns the result. It may well delete it — but it could log it, and you have to trust that it doesn't.
- Sent to a server and stored. Anything with history, sharing links or "save" buttons keeps your text, often longer than you expect.
Many tools mix these: local for simple jobs, a server for heavier ones. The privacy policy rarely says which is which.
How to check a tool in a minute
- Open your browser's developer tools (F12 on Windows, ⌥⌘I on a Mac) and choose the Network tab.
- Clear the list, paste some harmless test text and press the tool's button.
- Look at the new requests. If one of them carries your text — click it and look at the payload — the text left your computer. If nothing new appears, or only images and ads load, the work happened locally.
Do this with made-up data, never with the real secret.
How AXS TXT handles it
All 49 tools on AXS TXT run in the page. There is no save, share or history feature, so there is no store of pasted text to expose. Passwords, UUIDs and random numbers are generated with the browser's secure random generator; SHA hashes use the built-in Web Crypto API. The security page explains what is loaded and how to verify it with the steps above.
What local tools don't protect you from
A tool that uploads nothing still runs on your computer, and so does everything else:
- Browser extensions with permission to "read and change data on all websites" can see what you type into any page.
- Clipboard history (Windows key + V, clipboard managers, phone sync) keeps copies of what you copied.
- Screenshots and screen sharing capture whatever is on screen, including a decoded token.
Rules of thumb
- Treat API keys, tokens and passwords as live secrets. Use expired or test values when you only need to see the structure, and revoke anything you pasted somewhere you shouldn't have.
- Prefer tools that process locally for anything containing personal or customer data.
- Never use a "save" or "share" feature for a snippet with secrets in it, on any site.
Start with the tools developers paste secrets into most: JWT Decoder, JSON Formatter, Base64 and Hash Generator.