I built 104 developer tools that never send your data anywhere — and made it provable, not promised

Developers often copy-paste sensitive data into online JSON formatters without realizing the risks involved. An API response containing a customer's email, a JWT from a staging environment, or a testing configuration file can all pose potential security threats. Recognizing the need for safer alternatives, the author developed 104 developer utilities called ToolsSonic.

These tools run entirely in the browser, with no account creation, data uploads, analytics, or cookies. The focus was on making it provable that user data never leaves the page. The site is built using static HTML, CSS, and vanilla JavaScript, with a CDN serving the files. No backend is involved, eliminating the need for users to trust vague privacy policies or promises of data protection.

The author achieved this by avoiding common pitfalls such as using fetch, XMLHttpRequest, navigator.sendBeacon, WebSockets, or form submission in the tools. Instead, the tools utilize the browser's Performance API to track network requests and provide real-time proof of data staying local. For example, a JSON formatter that preserves original scalar lexemes as strings avoids precision loss for large numbers and duplicate keys, ensuring accurate representation.

Similarly, the JWT verification tool utilizes the browser's crypto.subtle API to import and verify HMAC, RSA, and ECDSA keys locally, providing explicit feedback when an algorithm is unsupported. This approach ensures developers can confidently use these tools without compromising sensitive data or relying on unverified security assurances.