How DevSecSuite works
Every tool on this site runs entirely in your browser. Nothing you type, paste, or upload is sent to a server — not to us, not to any third party. This page explains exactly how that works and how you can verify it yourself.
The core principle: client-side by default
Most online developer tools work like this: you type something into a box, it gets sent to a server, the server processes it, and the result comes back. That model works — but it means your data leaves your machine. For developers handling JWT tokens, hashes, SQL queries, or password material, that's a problem.
DevSecSuite is built the opposite way. Every tool is a static HTML page with JavaScript that runs locally in your browser. When you click "Generate" or "Convert," the computation happens on your own device using standard browser APIs. There is no backend. There is no API endpoint. There is no database.
In practical terms: if you disconnected from the internet after loading the page, every tool would keep working. That's the test.
What this means for each tool
| Tool | How it runs locally |
|---|---|
| Base64 encoder/decoder | Uses the browser's native btoa() and atob() functions |
| Hash generator | Uses the Web Crypto API (crypto.subtle.digest) |
| JWT decoder | Splits the token and decodes the Base64 payload in JavaScript |
| UUID generator | Uses crypto.randomUUID() — the browser's secure random source |
| Password generator | Uses crypto.getRandomValues() for cryptographic randomness |
| JSON/YAML/XML/SQL formatters | Parse and reformat strings in JavaScript — nothing leaves the page |
| Regex tester | Uses the browser's native RegExp engine |
| Cron parser | Pure JavaScript date logic |
| Unix timestamp converter | Uses JavaScript's Date object |
| Diff checker | String comparison in JavaScript |
| Markdown previewer | Converts Markdown to HTML in the browser |
| Color picker | Uses the browser's native color input |
| URL encoder/decoder | Uses encodeURIComponent() and decodeURIComponent() |
| HTML entity encoder | String replacement in JavaScript |
| bcrypt generator | Runs bcrypt.js locally (client-side library) |
How to verify it yourself
You don't have to trust this page. You can confirm it in about 30 seconds using your browser's developer tools.
The 30-second test
- Open any DevSecSuite tool, e.g. the Base64 encoder.
- Press F12 (or right-click → Inspect) to open DevTools.
- Click the Network tab.
- Clear the network log (trash icon).
- Type a test string into the tool and click "Encode."
- Watch the Network tab. No new requests appear. Nothing was sent.
Try the same test on any tool. You'll see the same result every time.
What we do NOT do
- We do not log your inputs. There is no server to log them on.
- We do not store your data. There is no database.
- We do not sell or share anything you enter. We never receive it.
- We do not require an account. No signup, no email, no login.
What we DO collect
Two things, and only two:
- Anonymous analytics. We use Google Analytics to count page views and see which tools are most used. This records the page URL and general region — not what you type into the tools.
- Basic hosting logs. Our static host (Cloudflare Pages) records standard web server info like IP and user agent for abuse prevention. This is normal for any website.
Neither of these has any visibility into the content you process inside the tools. See the Privacy Policy for details.
Open standards, not proprietary magic
Every tool uses publicly documented standards:
- Base64 — RFC 4648
- UUIDs — RFC 4122
- JWT — RFC 7519
- Cron — POSIX crontab spec
- Hashing — W3C Web Crypto API
You can independently verify any output by comparing it against a command-line tool on your own machine. For example: run echo -n "hello" | base64 in a terminal and paste "hello" into our Base64 encoder. The results will match.
Why we built it this way
Developers and security engineers handle sensitive material all day: API keys, JWT tokens, password hashes, production SQL. Using a random web tool that sends that material to an unknown server is a real risk — one most people don't think about until it's too late.
DevSecSuite exists to eliminate that risk. The tools are simple, they do one thing well, and they never see your data. That's the whole point.
Missing a tool?
If you have a suggestion for a tool that would fit — especially if you're tired of sending sensitive data to some other site — let us know via the contact page.
Last updated: 2026-09-27. This page is maintained by Emiliano.