About ToolDeck
Developer tools that never see your data.
Why it exists
Most “online tools” are convenient until you paste something that matters: an API payload, a JWT, a private key fragment, a production config, a password for an htpasswd line. Then you are gambling that a stranger’s server will forget it.
ToolDeck is 57 small pages for the jobs developers and sysadmins do many times a week. Formatting, encoding, hashing, decoding, explaining a cron line. Each one runs as JavaScript (and, for SQLite, WebAssembly) in your tab. There is no account, no upload API, and no “processing backend” for your input.
Who builds it
Ewan — builder, based in Sydney, Australia. Software engineer. ToolDeck started as the bookmark folder he kept opening during incidents and code reviews — then as a promise that those pastes would never leave the laptop.
It is a one-person project on purpose. That keeps the surface area small, the promise honest, and the changelog short enough to read.
How to verify the privacy claim
- Open a tool you care about.
- Open your browser’s developer tools → Network.
- Paste or type something distinctive and run the tool.
- You should see the page and its scripts load — and no request that carries what you typed.
After first load you can go offline and keep working on most tools. The site also ships a Content Security Policy that only allows connections back to this domain, so a script cannot quietly exfiltrate input elsewhere.
What we refuse to ship
- Tools that must send your text to our servers (DNS lookup, “fetch this URL”, remote screenshotters).
- JWT signing or “mint a token” — decoding without calling it verification is the line.
- Vague security theatre: meters that guess password strength for a password you already chose, or calling Base64 encryption.
- A content mill. The old blog is gone (HTTP 410). Explanations live under the tool they belong to.
Correctness
Each tool’s logic has automated tests with known-good values, including empty and malformed input. Where a tool cannot do something, the page says so: the JWT decoder does not check signatures; the certificate decoder does not check trust; MD5 and SHA-1 are labelled as weak for passwords.
History
The changelog is the public record of how the tools grew — from the first JSON and Base64 pages through the client-side rebuild and the sysadmin set.
What is collected
Page views are measured with Google Analytics and with Vercel Web Analytics and Speed Insights. None of them receive tool input. Detail is on the privacy page.
Contact
Questions, corrections, or a tool that should exist: hello@tooldeck.net.