Don’t trust us. Check.

Every tool site says your data stays local. None of them let you confirm it. Here the guarantee is a response header your browser enforces, so you can read it yourself and take our word for nothing.

Check it in ten seconds

01Open any tool page, then open DevTools.
02Go to the Network tab and use the tool. Paste a token, drop a HAR, run a diff.
03Nothing appears. Not an upload, not analytics, not a font.
04Select the page's own request and read its Content-Security-Policy response header. That is the whole proof.

The header we ship

response header · every strict route

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'wasm-unsafe-eval' <inline hashes>;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: blob:;
  font-src 'self';
  connect-src 'none';
  worker-src 'self' blob:;
  object-src 'none';
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'none'

connect-src 'none' blocks fetch, XHR, WebSocket, EventSource and sendBeacon. form-action 'none' blocks form submission. Together they mean a compromised dependency inside our own bundle still could not send your paste anywhere: the browser refuses before our code gets a say.

Where the exceptions are, and why

A page running anything other than the strict policy says so in its own badge, generated from the same registry field that generates its header. There is no page here that quietly runs something weaker than what it displays.

strict — connect-src 'none': Your browser blocks every request this page could make. Nothing you paste can leave your machine, even if our own code tried to send it. This is every tool but one.
self-fetch — connect-src 'self': This tool needs a WebAssembly binary, and loading it is a fetch. The browser permits requests to tabonly.com and nowhere else. tabonly.com serves static files: there is no endpoint that accepts a request body, and form-action 'none' still holds.
ads — csp: ads: Not in use today. If a commodity converter page ever carries one ad unit, that page talks to the ad network and its badge says so. Never a flagship tool, never /verify.

What we collect

Nothing, in your browser. There is no analytics script on this site, because a script that reported anything would have to make a request, and it cannot. Traffic is counted at the CDN from the request itself — the same server log any website has — and it never sees what you pasted, because what you pasted was never sent.