Security

Security isn't a page I bolted on at the end; it's the reason the site is built the way it is. The guiding principle is simple: don't collect what we don't need, and don't move your files anywhere they don't have to go. Here's what that looks like in practice.

Your files stay on your device

The majority of our tools run entirely in your browser using client-side processing. Your file is opened, worked on, and saved on your own computer or phone — it is never uploaded for these tools. There's no server copy to be leaked, intercepted, or subpoenaed, because your file never reaches a server in the first place. This is the strongest privacy guarantee there is, and it's the default across most of the site.

Server-processed tools

A small number of tools genuinely need server processing to do their job. For those, uploads travel over an encrypted HTTPS connection, are stored under randomized names in an isolated temporary location, are never indexed or read beyond performing your task, and are deleted automatically within one hour. We never store the contents of your files in our database.

Encryption in transit and at rest

All traffic to and from the site is served exclusively over HTTPS, so data moving between your browser and our server is encrypted. Sensitive secrets that we do store on the server — such as third-party API keys — are encrypted at rest using AES-256. Your account password is never stored in plain text; it's protected with a modern, slow one-way hashing algorithm, which means even we can't see it.

Accounts & sessions

Sign-in is protected on several fronts. Session cookies are HTTP-only, so they can't be read by scripts in the browser, and they're marked secure so they only travel over HTTPS. Every state-changing form is protected against cross-site request forgery (CSRF) with a per-session token. Sign-in attempts are rate-limited to resist brute-force and credential-stuffing attacks. You can sign in with a password or with Google, and "keep me logged in" is handled with a secure, revocable token rather than by weakening the login itself.

Email authentication

Email we send — verification messages, password resets, and newsletters — is authenticated with SPF, DKIM, and DMARC records on our domain. This helps mail providers confirm that a message really came from us and makes it harder for anyone to spoof our address.

Abuse prevention

We work from a one-way hashed form of your IP address rather than the raw address for rate limiting and abuse detection, and we filter out automated bot traffic. The aim is to keep the tools fast and available for real people without building a profile of anyone.

Our honest limits

No online service can promise perfect security, and I won't pretend otherwise. What I can promise is that the architecture is designed to minimize risk — mostly by not holding your data in the first place — and that I take reports seriously and fix issues quickly. For your part, please use a strong, unique password and keep your account credentials private.

Reporting a vulnerability

If you believe you've found a security issue, I want to hear about it. Please report it through our contact form with enough detail to reproduce it (choose the "Bug report" topic). I appreciate responsible disclosure — please give me a reasonable chance to fix an issue before making it public, and don't access or modify other people's data while investigating. I'll respond as quickly as I can.