Your Data Deserves Better
In November 2025, a major online developer tools site exposed 5GB of user data — including API keys, database credentials, and bank account numbers. The data had been accessible for nearly five years.
The Incident: What Happened
In November 2025, security researchers discovered that CodeBeautify and JSONFormatter.org had been exposing user data through misconfigured cloud storage. The exposed dataset included:
- 5GB of user-submitted data — everything users pasted into the tools
- API keys and tokens — AWS, Google Cloud, Stripe, and other service credentials
- Database connection strings — with usernames and passwords in plain text
- Bank account numbers and financial data — from JSON payloads users formatted
- ~5 years of exposure — the data had been accessible since approximately 2020
The root cause was simple: these tools sent every input to their servers for processing, then stored the data. When the storage was misconfigured, years of sensitive data became publicly accessible.
How devformat.tools Is Different
The fundamental problem isn't a misconfiguration — it's the architecture. If a tool sends your data to a server, that data can be leaked, logged, sold, or breached. The only way to guarantee safety is to never send the data at all.
| Feature | devformat.tools | Typical Online Tools |
|---|---|---|
| Processing location | Your browser (client-side JS) | Their server |
| Data storage | Never — nothing sent | Stored on server (often indefinitely) |
| Tracking cookies | None | Google Analytics, ad trackers, session cookies |
| Account required | No | Often yes (for "saving" results) |
| Network requests | Zero (verify in DevTools) | POST to their API on every input |
| Cryptography | Web Crypto API (browser-native) | Server-side (you trust them) |
How It Works: Client-Side Processing
Every client-side tool on devformat.tools runs entirely in your browser using JavaScript. When you paste JSON into our formatter, the formatting happens in your browser's JavaScript engine. The data never touches a network request. You can verify this yourself: open your browser's DevTools (F12), go to the Network tab, and use any tool. You'll see zero data requests.
For cryptographic operations (hashing, UUID generation), we use the Web Crypto API — the same cryptographic library your browser uses for HTTPS. This provides cryptographically secure random number generation without any server involvement.
Server-Side Tools: In-Memory Only
A few tools (YAML conversion, Markdown preview, CSV parsing) use server-side processing for accuracy. For these tools:
- Input is processed in-memory only — never written to disk
- No logging of input or output data
- No database — there's literally nowhere to store your data
- The server runs on minimal infrastructure with no analytics or tracking services
Frequently Asked Questions
Is it really safe to paste sensitive data like API keys?
For client-side tools, yes. Your data never leaves your browser. For server-side tools, we process in-memory with no logging, but if you're handling extremely sensitive credentials, we recommend using the client-side tools or running our open-source code locally.
How can I verify that data isn't being sent?
Open your browser's DevTools (F12), switch to the Network tab, then use any client-side tool. You'll see zero outgoing requests containing your data. This is impossible to fake — the browser's Network tab shows all network activity.
Do you use cookies or tracking?
No. devformat.tools sets zero cookies. We don't use Google Analytics, Facebook Pixel, or any other tracking service. There are no session identifiers, no fingerprinting, and no user accounts.
What about the ads?
We use privacy-respecting ad networks (EthicalAds) that serve ads based on page content, not user tracking. No cookies are set for advertising. If you use an ad blocker, the site works identically — we never gate features behind ad blocker detection.
Is devformat.tools open source?
The architecture is transparent: you can inspect every client-side tool by viewing the page source or checking the JavaScript files in your browser's DevTools. All processing logic is visible and auditable.