Stop pasting secrets into random websites

Here's a habit almost every developer has. You need to prettify some JSON, you search "json formatter," you click the first result, and you paste in the response you're debugging. Quick, done, move on. The trouble is what was in that response — maybe an auth token, a customer record, an internal URL — and where it just went.

A lot of online tools do their work on a server. You paste, your text gets sent off, the server formats it and sends it back. For public sample data, fine. For anything out of a real system, you've just handed a stranger's machine a copy of something you probably were not supposed to share.

Why this is more than paranoia

Most of these sites aren't malicious. But "not malicious" and "safe" aren't the same thing. The data still crosses the network, may land in server logs, might be kept for analytics, and is now subject to whatever that site's security happens to be. If you work somewhere with compliance rules, pasting a customer email into an unknown third party can be a reportable incident on its own — no hacker required.

The awkward part is that you usually can't tell from the page. A clean design and an HTTPS padlock say nothing about whether your input leaves the browser. The padlock means the connection is encrypted, not that the data stays put.

How to check

You can actually see what a tool does. Open your browser's developer tools, switch to the Network tab, and use the tool. If you paste something and a request fires off carrying your text, it's processing server-side. If nothing leaves, the work is happening locally. For a tool you lean on often, that thirty-second check is worth doing once.

Another tell: try it offline. Disconnect from the network and use the tool. Anything that still works clearly isn't phoning home. Anything that breaks was depending on a server.

The simple rule

Treat anything from a real system — tokens, keys, customer data, internal config — as something that should never touch a server you don't control. For those, use tools that run entirely in your browser. That is the whole reason Bytewrench works the way it does: the JSON you format, the token you decode, the hash you generate, all of it stays on your device. Nothing is uploaded, because there's nothing on our end to upload it to.

So format the mystery API response in our JSON formatter, inspect that token in the JWT decoder, and do it knowing the data didn't go anywhere. Old habits are hard to break. This one is worth it.