Privacy
Last updated 26 October 2026
The short version
- There are no accounts, no ads and no database. We don't sell or share anything about you.
- 33 of the 48 tools run entirely in your browser: what you paste, type or open in them never reaches our server. One of them, the Password Breach Check, sends five characters of a hash to Have I Been Pwned (see below).
- The other tools, DNS and email lookups and checks against servers, have to run on our server. They send what you enter to the services listed below to get you an answer, and don't keep it.
- Like every website, the server's log records each request. Google Analytics counts page visits.
- Share links that carry your input after a # never reach our server or Google Analytics.
Tools that run in your browser
These pages download their code once and then work on your device (it's .NET running in WebAssembly). Text you paste, files you open and keys they generate stay in the page and are gone when you close it. You can check: open your browser's developer tools (F12), go to the Network tab and use the tool; no request carrying your input is made. A few of them (IPv4 Subnet Calculator, IP Address Converter, CAA Record Builder, Shell Translator, UUID / GUID Generator, Unix Timestamp Converter, Cron Expression Tool) also keep a short public value, such as an IP address or a timestamp, after a ? in the address bar so the page can be bookmarked. Typing doesn't send it anywhere; it reaches our server only when you reload or share that address.
- IPv4 Subnet Calculator
- IP Address Converter
- Email Header Analyzer
- DMARC Report Analyzer
- Certificate Decoder
- Certificate Converter
- Key Matcher
- CSR Generator
- Private CA Builder
- CAA Record Builder
- Hash Generator
- JWT Decoder
- Password Breach Check
- Instant Keys
- Password Generator
- PSK Generator
- Robocopy Command Builder
- Shell Translator
- PowerShell Alias Decoder
- Base64 Encode / Decode
- URL Encode / Decode
- HTML Entity Encode / Decode
- Number Base Converter
- UUID / GUID Generator
- Unix Timestamp Converter
- Cron Expression Tool
- JSON Formatter
- YAML / JSON / XML Converter
- CSV / JSON Converter
- Case / Text Transform
- Text Diff
- Regex Tester (.NET)
- Markdown Preview
The exception is the Password Breach Check: your browser computes the password's SHA-1 hash and sends only its first five characters to Have I Been Pwned, which returns every breached hash starting with them (with padding, so the size of the reply gives nothing away). The comparison happens in your browser. The password itself never leaves your device, and neither does the full hash.
Tools that use our server, and what they send where
A browser can't make DNS queries, test a mail server's blocklist status or open a TLS connection to another server, so these tools run on our server. It sends what you enter (a domain name, host name or IP address) to the services below, shows you the result, and keeps nothing beyond a short-lived cache in memory (up to an hour) so repeated lookups are fast. Lookups are rate-limited per IP address; the counter lives in memory for about a minute and is never written down.
| Tools | What's sent | To whom |
|---|---|---|
| DNS Lookup, CAA, TXT, MX, SPF, DKIM, DMARC, Email Health | The domain name and record type | The public DNS resolver you pick (Google DNS by default; also Cloudflare, Quad9, OpenDNS, Control D, AdGuard, CleanBrowsing) |
| Blacklist Check | The IP address, or the domain's mail-server addresses | The blocklist operators shown on the page (Spamhaus, SpamCop, Barracuda and others), as DNS queries |
| TLS Certificate Checker, Chain Builder, Security Headers | A connection to the host and port you enter (and, for Chain Builder, the certificate's own "CA issuers" download address) | That server, which sees a visit from our server, not from you |
| Certificate Transparency Search | The domain name | crt.sh, and Cert Spotter if crt.sh doesn't answer |
| My IP Details | Your IP address (or the one you enter) | MaxMind GeoLite (approximate location), rdap.org (the registry that owns the address), Team Cymru (network owner, a DNS query). The Tor Project's public exit list is downloaded; your address isn't sent there. |
| My IP Details: WebRTC leak test | Your browser asks a STUN server what address it sees | Google's public STUN server (stun.l.google.com), contacted by your browser directly |
Nothing else is contacted. The server never follows a web address you type except to the host you asked it to check, and only public addresses are allowed.
What our server records
The web server (IIS) logs every request the way all web servers do: the time, your IP address, the page address including anything after a ? (for example ?domain=example.com), your browser's user-agent string and the referring page. These logs are used to keep the site running and to spot abuse, and are kept for a limited time as part of normal server housekeeping. That's why share links that would carry anything sensitive never use the ? part (see below). The server and its logs are in the United States.
Share links
- Lookups and simple converters (DNS, IP, timestamps, cron, Shell Translator searches) keep their input in the page address after a ?. That part is sent to our server and to Google Analytics, so these tools only ever put public, structured values there, like a domain name or a number.
- Text tools and builders (Base64, Regex, Diff, converters, Robocopy…) only create a link when you click Copy link, and they put your input after a #. Browsers never send that part to any server, and our analytics script reports pages without it. The link is refused if the input looks like it contains a password, key or token. Anyone you give the link to can read the input, so treat it like the text itself.
- Password, key and certificate tools have no share links at all.
Cookies
| Cookie | Set by | Why | Lasts |
|---|---|---|---|
| .AspNetCore.Antiforgery.* | tclient.com | Security: stops other sites from submitting forms here in your name. Contains no information about you. | Until you close the browser |
| _ga, _ga_* | Google Analytics | Tells repeat visits apart from new ones, so page counts are meaningful. | Up to two years |
Google Analytics
We use Google Analytics 4 to see which pages and tools are used. It records the pages you visit (without anything after a #), how you arrived, your approximate location (country or city), and your device, browser and screen size. Google says Analytics 4 doesn't log or store IP addresses. We don't send Google anything you type into a tool. Google's own use of this data is described in how google uses information from sites that use its services. To opt out, use the Google Analytics opt-out browser add-on or any content blocker: every tool works the same without it.
Changes
When the site changes what it collects or where data goes, this page changes with it and the date at the top is updated. The lists of browser and server tools above are generated from the site's own code, so they're always current.