Tidybyte
  • Base64 Encode & DecodeEncode and decode Base64 in your browser, UTF-8 safe, with a URL-safe variant. Nothing is uploaded.
  • JSON Formatter & ValidatorFormat, validate and minify JSON in your browser. Pinpoints syntax errors and converts MongoDB shell text. Nothing is uploaded.
  • JWT DecoderDecode a JSON Web Token in your browser: header, payload and expiry in human time. Decode only: no verification, nothing is uploaded.
  • Regex TesterTest JavaScript regular expressions with live match highlighting and capture groups. Runs in your browser; nothing is uploaded.
  • Text DiffCompare two texts line by line or word by word, inline or side by side. Runs in your browser; nothing is uploaded.
  • Timestamp ConverterConvert Unix epoch seconds or milliseconds to ISO 8601 and back, in any timezone. Runs in your browser, nothing is uploaded.
  • URL Encode, Decode & ParsePercent-encode and decode URLs and query strings, or break a URL into its parts. Runs in your browser; nothing is uploaded.
  • UUID & Hash GeneratorGenerate UUID v4 and v7 and compute SHA-1, SHA-256, SHA-384 and SHA-512 hashes with Web Crypto. Runs in your browser, nothing is uploaded.
Theme

Privacy

Everything you paste into Tidybyte is processed in your browser. It is never sent anywhere, and the browser itself is told to refuse to send it.

You do not have to trust us

A promise in a policy is easy to write. So Tidybyte does not rely on one. Every response is served with a Content Security Policy that contains connect-src 'none'. That directive makes the browser block fetch, XHR, WebSocket and similar connections made by the page, even to this same site. If a bug or a compromised dependency tried to upload your input, the browser would stop it.

The automated test suite checks this on every tool page: it loads the page, uses the tool, and fails if any request leaves, including a request to our own origin.

Check it yourself in two minutes

  1. Open your browser's developer tools and go to the Network tab.
  2. Open any tool and paste something into it. Watch the list: nothing new appears.
  3. Optional: in the Console tab runfetch(location.origin). It fails with a Content Security Policy error.
  4. Optional: switch to Offline in the Network tab (or turn off Wi-Fi) after the first visit and keep using the tools. They keep working, because there is nothing to call.
  5. Optional: select the first request in the Network tab and read theContent-Security-Policy response header.

What is stored, and where

  • Cookies: none. Tidybyte sets no cookies.
  • Analytics, trackers, third-party scripts, fonts, CDNs: none. Every script, style and font comes from this site.
  • The address bar: a tool keeps its input and options in the part of the URL after #, so you can bookmark or reload your work. Browsers never send that part to a server. But if you share the link, you share what is in it. Inputs over 8 KB are not put in the URL.
  • Offline cache: your browser keeps a copy of Tidybyte's own files so the app works without a connection. It contains the app, never your input.
  • Local storage: only if you pick Light or Dark with the theme switch, the page saves that one word (tidybyte-theme) in your browser. On Auto nothing is written. Your input is never stored.

What the host can see

Tidybyte is a static site. When you load it, the web host serves files to you, and like any host it can see ordinary request data such as your IP address and which page you asked for. That happens before you type anything and does not include anything you paste.

What this does not protect against

  • A browser extension that can read pages, or malware on your machine. Those sit outside the page's policy.
  • Your own clipboard and screenshots. If you copy a secret out of Tidybyte, it is wherever you paste it next.
  • The offline cache's service worker is the one script allowed to contact this site, only to fetch Tidybyte's own files. It has no code path that touches your input.

Read the code

Tidybyte is MIT licensed. The header policy lives in public/_headers andastro.config.mjs, and the test that enforces it istests/e2e/privacy.spec.ts.