What are privacy tools?

Privacy tools are small programs that work with sensitive data without sending it to a server. They run in the browser tab, process input locally, and discard everything once the page is closed. Typical jobs are stripping metadata from photos, computing file hashes for integrity, generating secure passwords, and decoding auth tokens.

What data do EXIF metadata contain?

EXIF metadata in photos often include GPS coordinates of the capture location, date and time, camera model with serial number, focal length, exposure time, ISO value, sometimes the editor's name and the editing software used. On smartphone photos, a device ID is added. More on EXIF on Wikipedia.

How can I verify a file has not been tampered with?

Download the file and compute its hash, usually SHA-256. Compare the result against the hash the publisher posted on their website. If every character matches, the file is bit-identical to the original. A single changed byte produces a completely different hash.

Are the inputs uploaded?

No. Inputs for these tools are processed in the browser tab and are not sent to our server for processing. There is no signup. Site usage measurement is separate and described in the privacy policy.

Is my data stored anywhere?

No. There is no server upload and no database that captures inputs. The tools load their code into the browser once, then everything runs in the browser tab's RAM. As soon as the tab closes, everything is gone. Browser cache only covers the tool code itself, never your inputs.

What is the difference between hashing and encryption?

A hash is one-way: a file or text becomes a fingerprint from which the original cannot be recovered. Encryption is reversible: with the right key, the ciphertext becomes readable again. Hashes are used for integrity checks, password storage and signatures; encryption is used for confidential transmission.

Can I generate passwords in the browser? Is that secure?

Yes, provided the generator uses the WebCrypto API. It is part of every modern browser and sources cryptographically secure randomness directly from the operating system's entropy pool. That is the same source password managers use. The only thing that matters is that the generator never logs the output. For local tools without a server path, that is impossible.

What is inside a JWT token?

A JSON Web Token has three parts: header (algorithm + token type), payload (claims like user ID, roles, expiry, issuer), and signature. Header and payload are only Base64-encoded, so anyone can read them, and the signature only protects integrity, not confidentiality. Anyone who finds a token in a URL or a logfile can read its contents.

Why should I strip metadata at all?

Metadata often reveal more than the file content itself. A photo with GPS coordinates exposes the address where it was taken. A PDF shows the author's real name in the author field, and in tracked changes sometimes earlier versions with deleted sentences. Every external share (agencies, business partners, online platforms) is a potential leak.

Does this work without internet?

Yes. Once the tool page has loaded, it keeps working offline. You can switch off Wi-Fi and continue using the tools. The first visit downloads a few hundred kilobytes of code, then the page is cached. This is also GDPR-relevant: no server requests during processing, so no data flows to us or third parties.

Privacy Tools, Handle Sensitive Data Without Letting It Leave Your Browser

Seven browser-only tools for working with sensitive data: strip metadata, cover spots in an image, verify file hashes, generate passwords, decode JWT tokens, encode URLs. Inputs for these tools run in the browser tab and are not uploaded for processing. Built for whistleblower workflows, lawyers handling client data, developers with API keys in logs, and anyone who does not want every file to pass through a server logfile. More on the GDPR.

Which tool for which job?

Tool	Typical use case	What stays local	What never leaves
Remove metadata	Strip EXIF, GPS and author tags from photos and PDFs before sharing	File + metadata stream	GPS coordinates, camera serial number, editing software
Pixelate image	Cover faces, plates and account numbers on a photo, several spots in one pass	Image data + the boxes you drew	the un-redacted original, plus EXIF, GPS and the embedded preview thumbnail
File hash checker	Compare a downloaded file checksum against the source publisher	File bytes	File contents, filename, size
Password generator	Generate cryptographically secure passwords and passphrases in the browser	Random bytes from WebCrypto API	the generated password, never to a server
Hash generator	Compute SHA-256, SHA-512 or MD5 fingerprints for text and strings	Input text + hash output	the plaintext input
JWT decoder	Decode JSON Web Tokens locally, inspect header, payload and expiry	Token string + decoded fields	the token itself (often an auth bearer with identity claims)
URL encoder/decoder	Encode query parameters, API paths or tracking URLs, or make them readable	URL string + result	the URL (often with auth tokens, session IDs, internal paths)

Who needs privacy tools?

Privacy is not abstract, it has concrete professions that depend daily on sensitive data not leaving their machine:

GDPR compliance before sharingBefore a photo, a contract or a PDF goes out: strip metadata. EXIF GPS in images and author fields in PDFs are classic compliance pitfalls that can sink a GDPR review.
Whistleblowers and journalistsSource protection starts in the file header. Sending a photo to a newsroom also ships the location, camera serial number, and often the photographer's real name. Local processing is mandatory here, not a convenience.
Lawyers handling client dataAttorney-client privilege does not mix well with cloud tools. Hashing evidence PDFs, checking documents for tampering, generating client logins: these tasks need tools that hand nothing to third parties.
Developers with API keys and secretsJWT tokens, OAuth bearers and API keys end up in logs, in Slack snippets, in bug reports. Decoding them on a website that ships the token to a server is a known leak class, and the local decoder avoids it.
Healthcare and patient recordsPatient PDFs often expose dates of birth, insurance numbers and diagnoses in the file header. Before forwarding to rehab, insurer or expert: strip metadata, hash for integrity, done.
Personal photo sharingA vacation photo on Instagram may carry the GPS coordinates of your home. Anyone sharing photos without thinking about strangers' route planning should run them through the metadata tool first.

Tools at a glance

Remove metadataStrip EXIF, GPS and author tags from photos and PDFs before sharingOpen Pixelate imageCover faces, plates and account numbers on a photo, several spots in one passOpen File hash checkerCompare a downloaded file checksum against the source publisherOpen Password generatorGenerate cryptographically secure passwords and passphrases in the browserOpen Hash generatorCompute SHA-256, SHA-512 or MD5 fingerprints for text and stringsOpen JWT decoderDecode JSON Web Tokens locally, inspect header, payload and expiryOpen URL encoder/decoderEncode query parameters, API paths or tracking URLs, or make them readableOpen

Privacy

Inputs for these tools are processed in the browser and are not uploaded for processing. There is no database for those inputs and no signup. Site usage measurement is described in the privacy policy. As soon as the tab closes, the inputs are gone.

Frequently asked questions

What are privacy tools?: Privacy tools are small programs that work with sensitive data without sending it to a server. They run in the browser tab, process input locally, and discard everything once the page is closed. Typical jobs are stripping metadata from photos, computing file hashes for integrity, generating secure passwords, and decoding auth tokens.
What data do EXIF metadata contain?: EXIF metadata in photos often include GPS coordinates of the capture location, date and time, camera model with serial number, focal length, exposure time, ISO value, sometimes the editor's name and the editing software used. On smartphone photos, a device ID is added. More on EXIF on Wikipedia.
How can I verify a file has not been tampered with?: Download the file and compute its hash, usually SHA-256. Compare the result against the hash the publisher posted on their website. If every character matches, the file is bit-identical to the original. A single changed byte produces a completely different hash.
Are the inputs uploaded?: No. Inputs for these tools are processed in the browser tab and are not sent to our server for processing. There is no signup. Site usage measurement is separate and described in the privacy policy.
Is my data stored anywhere?: No. There is no server upload and no database that captures inputs. The tools load their code into the browser once, then everything runs in the browser tab's RAM. As soon as the tab closes, everything is gone. Browser cache only covers the tool code itself, never your inputs.
What is the difference between hashing and encryption?: A hash is one-way: a file or text becomes a fingerprint from which the original cannot be recovered. Encryption is reversible: with the right key, the ciphertext becomes readable again. Hashes are used for integrity checks, password storage and signatures; encryption is used for confidential transmission.
Can I generate passwords in the browser? Is that secure?: Yes, provided the generator uses the WebCrypto API. It is part of every modern browser and sources cryptographically secure randomness directly from the operating system's entropy pool. That is the same source password managers use. The only thing that matters is that the generator never logs the output. For local tools without a server path, that is impossible.
What is inside a JWT token?: A JSON Web Token has three parts: header (algorithm + token type), payload (claims like user ID, roles, expiry, issuer), and signature. Header and payload are only Base64-encoded, so anyone can read them, and the signature only protects integrity, not confidentiality. Anyone who finds a token in a URL or a logfile can read its contents.
Why should I strip metadata at all?: Metadata often reveal more than the file content itself. A photo with GPS coordinates exposes the address where it was taken. A PDF shows the author's real name in the author field, and in tracked changes sometimes earlier versions with deleted sentences. Every external share (agencies, business partners, online platforms) is a potential leak.
Does this work without internet?: Yes. Once the tool page has loaded, it keeps working offline. You can switch off Wi-Fi and continue using the tools. The first visit downloads a few hundred kilobytes of code, then the page is cached. This is also GDPR-relevant: no server requests during processing, so no data flows to us or third parties.