Security: Verify Your Data Stays Local

The Short VersionEvery tool runs in your browser. Nothing you paste or generate is uploaded, logged, or stored, and you don't have to take my word for it: the checks below take about a minute.

1. How the Tools Handle Your Data

worktools.dev is a static site. The server only sends HTML, CSS, JavaScript, and images; there is no backend API, no database, and nowhere for tool input to be sent.

When you paste JSON into the Strapi converter or generate placeholder text, the work happens in JavaScript running in your browser tab. The tool code contains no network calls, and the result exists only in that tab. Close or reload it and the data is gone.

2. Check It Yourself

Either of these checks works in any modern browser:

Watch the Network Tab

Step 1

Open Browser DevToolsPress F12 (or ⌘+Option+I on macOS).

Step 2

Select the Network TabOpen the Network tab and clear the log so only new requests show up.

Step 3

Use a ToolPaste a JSON response or generate placeholder text. No new requests appear, because the tools never send your input anywhere.

Use a Tool Offline

Step 1

Open a ToolLoad any tool page, such as the Strapi converter or the German ipsum generator.

Step 2

Go OfflineTurn off Wi-Fi, or set DevTools network throttling to "Offline".

Step 3

Keep WorkingPaste JSON or generate text. The tool works the same, because it never needed a server.

3. Content Security Policy

A Content Security Policy (CSP) is a response header that tells your browser what a page is allowed to load and which servers it may contact. Every page on worktools.dev is currently served with this policy:

Current CSP Header

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';

connect-src 'none'

Scripts on the page cannot open network connections: fetch(), XMLHttpRequest, WebSocket, EventSource, and navigator.sendBeacon() are all refused by the browser.

img-src 'self' data:

Images load only from worktools.dev or inline data URLs, so an image request cannot be used to carry data to another server.

object-src 'none'

Plugin content such as <object> and <embed> elements is blocked entirely.

frame-ancestors 'none'

Other sites cannot embed worktools.dev in an iframe, which prevents clickjacking. X-Frame-Options: DENY does the same for older browsers.

form-action 'self'

HTML forms can only submit to worktools.dev.

4. What the Policy Does Not Cover

A CSP limits what the page can load and connect to, but it isn't a complete wall. It doesn't stop a script from navigating the whole tab to another site, and it has no effect on browser extensions you have installed, which can read any page you visit.

That's why the policy is a second layer, not the main one. The main protection is simpler: the tools contain no code that sends your input anywhere, which the checks above let you confirm. For sensitive data, use a browser profile without third-party extensions.

5. Reporting a Security Issue

If you find a way around the policy, an unexpected network request, or another vulnerability, please email security@worktools.dev with steps to reproduce it.

worktools.dev is maintained by one developer. I aim to acknowledge reports within three business days and will keep you updated until the issue is fixed. Please give me a reasonable chance to fix it before sharing details publicly.