The paste problem
The moment you paste a JWT, a cURL command with a live bearer token, or a production JSON dump into a website, you have given that operator a credential or a copy of customer data. Many “formatters” are a textarea and a POST handler. Even if the operator is honest, logs, CDNs, error trackers, and lawful intercept still exist. A tool that never sends the payload is a different architecture: HTML and JavaScript are downloaded once; your data stays in RAM in the tab.
Why nothing is uploaded
PureDevKit is a website of pages and scripts that run in your tab. There is no account, no paste inbox, and no database of what you typed. After the page loads, formatting and conversion happen on your device. We cannot sync history across phones for you, and the tools do not send your drafts to our inbox — those are the same tradeoffs that keep tokens and dumps off our servers.
Workers, Web Crypto, and honest limits
Browsers now expose HMAC, SHA-2, CSPRNG, and file APIs that used to require a backend. MD5 is implemented in JS only because Web Crypto omitted it. Huge files can still freeze a tab; a desktop `sha256sum` is better for multi-gigabyte ISOs. Regexes can still backtrack. Client-side is not magic — it is a trust boundary at the device you already use to look at the secret.
Advertising without harvesting payloads
If this site shows ads, they are separate from the tools. Your JSON is not used as an ad targeting signal from the editor. Cookie consent covers site preferences and optional advertising cookies, not a log of what you pasted. Use the in-page search to jump between tools, and treat any formatter that needs to send your payload to a server as a last resort.