Why Browser-Based Tools Are More Private (and How to Check)
What it means when a tool runs in your browser, why that protects what you type, and a two-minute way to verify any site's claim yourself.
"Your data never leaves your device" is a claim many online tools make. It is also a claim you can check yourself in about two minutes, without being a programmer. This guide explains what a browser-based tool is, why it is usually the more private choice for things like formatting a document or sorting a list of names, and exactly how to verify it. It also says plainly what the approach does not protect.
Two ways a web tool can work
Server-based tools send what you type to a computer run by the site's owner. The server does the work and sends back the answer. Your input travels across the internet, may be logged, and sits, even briefly, on someone else's machine.
Browser-based tools (also called client-side tools) download a small program, written in JavaScript, when you open the page. Your browser then runs that program on your own device. What you type is processed locally, and the site's server never sees it.
The Anagram Solver, Unit Converter, JSON Formatter & Validator and Team Generator on this site are all built the second way. Everything you enter is handled by your browser.
Why it matters
- Privacy. Text you paste, such as a JSON file with customer records or a list of your team's names, is not uploaded.
- Speed. There is no round trip to a server, so results appear as you type.
- Offline use. Once the page has loaded, many browser-based tools keep working without a connection, and installed web apps can be opened offline.
- Lower cost and fewer moving parts. There is no account system or database to look after, which also means fewer places for something to go wrong.
How to check any tool in two minutes
Method 1: the offline test (easiest)
- Open the tool and let it finish loading.
- Turn off your Wi-Fi, or switch on airplane mode.
- Use the tool. If it still works, the processing is happening on your device.
A server-based tool fails at this step, because it has nobody to send your input to. Be careful with one thing: some tools cache their data from a previous visit, so a tool that does not need the network for a specific job can still talk to the network for others.
Method 2: watch the network traffic
- Open the page, then open your browser's developer tools (press F12, or Cmd-Option-I on a Mac) and choose the Network tab.
- Clear the list so you only see new activity.
- Type something distinctive into the tool, such as the made-up word zebra4821.
- Look at the new requests. Click one and check its Payload or Request details. If your distinctive text appears in a request to the site's server, the tool is sending your data out. If no request contains it, the tool is processing locally.
Traffic to advertising or analytics services is normal on free sites and does not by itself mean your input was shared, but look at what those requests actually contain.
Method 3: read the privacy policy
A trustworthy site says what is collected and what is not. Look for statements about what you type, about cookies, about advertising and analytics, and for a contact address. Vague or missing policies are a warning sign. Ours is on the Privacy Policy page.
What "browser-based" does not protect
It is worth being clear about the limits, because "private" is not an absolute.
- Loading the page is still a request. The site's host can see that your device asked for the page, along with technical details such as your IP address, as with any website. This is standard server logging.
- Ads and analytics are separate. A free site that shows ads loads code from advertising companies, and those companies may set cookies. That is separate from the tool's own processing. Privacy settings and consent choices control it.
- Share links contain your input. If a tool puts your entries in the web address so you can share or bookmark them, anyone who has the link can read them. Do not share such a link if the content is private.
- Some features reach out by design. A JSON formatter's "load from a URL" option makes your browser fetch the address you give it. That request goes to that address, not to us, and it is only made when you ask for it.
- Your device can be the weak point. Browser extensions can read pages, and shared computers keep history. Local storage, which many tools use to remember your settings, stays on your device until you clear it.
Good habits, whatever tool you use
- Do not paste passwords, private keys, API tokens or government identification into any online tool, even a private one. For secrets, use software installed on your own computer.
- Remove or replace real personal details with sample values when you only need to check the structure of some data.
- Prefer tools that explain how they work and say what they store.
- Clear a site's stored data from your browser settings if you used a shared device.
A note about our own tools
We build our tools to run in your browser on purpose, and we keep what is stored to a minimum: your theme choice, your last-used settings, and a saved copy of the site's files so installed apps work offline. See the Privacy Policy for the full list, and the About page for how we work. If you check a tool using the steps above and find something unexpected, please tell us.