§Privacy
Privacy
Short version: what you paste stays in your browser.
What you paste
Headers, policies, cookies and HAR files you paste or open are processed by JavaScript running in your browser tab. They are not uploaded, logged or stored on any server. Closing or reloading the tab discards them.
When a tool passes a policy to another tool (for example “Open in the CSP evaluator”), it travels in the part of the address after the #, which browsers never send to a server.
Live URL checks
The “Check a live URL” box on the home page is a link to WebTraceCheck, a separate website. Nothing is sent when you type; if you follow the link, WebTraceCheck receives the address you entered and its own privacy terms apply.
Analytics
The site uses Cloudflare Web Analytics, which counts page views without cookies or cross-site tracking. It never receives what you type, paste or drop into the tools. There are no other analytics, ads or trackers.
Cookies and storage
The site sets no cookies. If you choose a light or dark theme, that choice is saved in your browser's local storage under one key and never leaves your device.
Network access
The site's Content-Security-Policy allows connections only to this site and to Cloudflare's analytics endpoint, so the pages could not send your data elsewhere even by mistake. You can check this by pasting this site's headers into the analyzer.