Browser Environment
Security depends on your browser configuration.
- Use up-to-date browser (Chrome, Firefox, Edge, Safari)
- Disable unnecessary extensions
- Use Incognito/Private mode
- Avoid public computers
- No autofill for passwords
- Verify HTTPS (lock icon)
- Clear cache regularly
Recommendations only—not security assurance.
Browser Security Checklist
Extensions Disabled
Or use Incognito mode for sensitive tasks
Browser Updates
Keep your browser updated to the latest version
Private Mode
Use Incognito or Private mode for sensitive tasks
Browser Environment FAQ
Does a browser extension with read access to the page can read my data?
Yes, and this is the most important limitation on this page. An extension with host permissions for the site can read the DOM, so it can observe the plaintext you paste before encryption and the result after decryption. Our tools run in your browser precisely so that no server sees the data, but the page itself, and anything allowed to run inside it, still can. Review extension permissions for this site, and use a dedicated browser profile for sensitive work.
Is private mode safer for running these tools?
It helps in two specific ways and is worth enabling. First, it keeps local history and cache entries out of the profile, so a decrypted value is less likely to persist on disk. Second, it avoids reusing cookies from your normal session. It does not protect against an extension, a compromised device or a keylogger, and it leaves the data in memory exactly as long as the tab stays open.
Why do you list minimum browser versions?
Because the tools depend on the Web Crypto API and, for image work, on features added to the browser over time. The minimums we verify are Chrome 90+, Firefox 88+, Safari 14+ and Edge 90+. On an older browser the page may load but a specific tool can fail or fall back to a weaker path, which is worse than a visible error.
Can I verify the tools are really running locally?
Yes, and we encourage it. Open your browser's developer tools, switch to the Network tab, then use any tool: pasting text, hashing a string or encrypting a message should produce no new request carrying that data. Everything happens in the page's JavaScript context. What you will see is the page load itself and, on this site, one aggregate page-view measurement that carries no input.
Does clearing my browser cache improve security?
It reduces residue, not risk. Cached assets contain only the site's own code and static files, never the values you typed, because we never write inputs or results to storage. Clearing it is still reasonable hygiene on a shared machine, but if your concern is someone reading your last hash or ciphertext, the storage layer is not where that value lives.