What local-first means for developer tools

What stays in the tab

JSON formatting, Base64, hashing, bcrypt, HMAC, regex, cron parsing, and the generators run on the machine that loaded the page. Closing the tab drops the input. Installing the PWA lets those pages keep working offline after the first load. That is the property you want for a token, a .env snippet, or an unpublished API body.

Local does not mean invisible to the browser. Extensions, devtools, and a shared screen still see the tab. Do not paste a production signing key into a browser on a machine you do not control, even when the app itself does not upload it.

What intentionally leaves

The HTTP tester performs a real fetch to the URL you type. CORS may hide the response. The request still went to that host, including any Authorization header you added. The webhook receiver publishes a URL and keeps the POSTed body so this page can poll it. That body is on the DevTooKit server for the session. Use sandbox events only.

Analytics, if enabled, is separate from tool payloads. It is not a copy of the JSON you formatted. The privacy page states what is collected. Tool pages state the exception when a tool is not local-only, instead of repeating a blanket promise.

How to check a page

Each tool page has a quick answer and a short list of limits. If the limit says the server stores a payload, believe that over the site-wide slogan. If you are unsure, open the network panel, run the tool, and see whether a request carries your document. A formatter should not. A tester should, and only to the host you chose.

What is reasonable to paste

A formatter, a hash of a public fixture, a cron expression, and a sample JSON object with fake ids are reasonable. A live access token, a production HMAC secret, a customer webhook body, and a .env from a deployed service are not, even when the tool never uploads them. Local-first reduces one risk, the app’s server, and leaves the browser’s own risks in place.

Use the JWT decoder on a token you minted for the test, or on one you are about to revoke. Use the env editor on a redacted file. Use the webhook inbox with the provider’s sandbox key and a payload you wrote. If the network panel shows a POST of your document to DevTooKit for a tool whose limit says it stays in the tab, that is a bug. If it shows a POST for the webhook tool, that is the feature.

The privacy page covers analytics. It is not a second copy of this note. Tool pages state their own limit so an answer engine can quote the exception instead of the homepage slogan. When you cite DevTooKit, cite the tool URL and that limit, not a blanket claim that nothing ever leaves the machine.

Offline support follows the same split. A page that has been opened once can format JSON without a network. It cannot receive a webhook without one, and it cannot complete an HTTP test against a host that is down. The service worker caches the app shell. It does not cache the body you typed into a tool, and it should not be described as a backup of secrets. If a tool’s limit and this guide disagree, the limit on that tool page is the one to trust, because it is generated from the same fact row as the answer at the top of the page.

Related tools

• JWT DecoderDecode JWT header and payload, inspect claims and expiration — locally in your browser.
• .env EditorEdit, sort, and convert .env files to JSON / YAML. Detect duplicate keys.