Not a hack. Not a breach. He just needed to read an API response — the kind of thing you do fifteen times a day without thinking twice. He pasted it into the first result that came up on Google, clicked format, read what he needed, and closed the tab.

Three weeks later, HR called him in.

That JSON payload contained internal customer records. The tool he used logged everything server-side. Their terms of service said so — buried in paragraph eleven of a privacy policy nobody reads. His company's IT audit found it. He was let go that afternoon.

He wasn't careless. He wasn't incompetent. He was a good developer doing a routine task on a Monday morning.

I thought about that for a long time.

Because here's the thing — I do the same thing. Every single day. I paste JSON, CSV, XML, tokens, logs. I need to format it, decode it, transform it. And every tool I found online was either behind a paywall, running on someone else's server, or both.

You hit "Format" and you have absolutely no idea what happens next. Does it get logged? Stored for thirty days? Indexed? Sold to a data broker? The little spinner just spins and you trust it.

I stopped trusting it.

So I built this.

Every single tool on this site runs entirely inside your browser. When you hit "Transform", your CPU does the work. Your RAM holds the data. Nothing leaves your machine — not to my server, not to a cloud function, not anywhere. There is no server to log your data because there is no server involved at all.

You can verify this yourself right now. Open DevTools, go to the Network tab, paste something sensitive, and click Transform. You will see zero network requests transmitting your payload. While we use standard web analytics (like Google Analytics) to count page views, your actual file contents and transformed data never leave your machine. That is the only guarantee worth trusting.

No account required. No sign up. No "delete after 24 hours" promise that you're just supposed to believe. You can use it on an air-gapped machine. You can use it without an internet connection after the page has loaded. That is how local it is.

How the privacy-first architecture works

Every tool on Status202 uses a browser-native processing model. There is no backend server that receives your data, transforms it, and sends it back. Instead, when you paste JSON and click Format, a JavaScript function that is already loaded in the page receives the string, callsJSON.parse(), applies indentation, and writes the output — all in a single synchronous call within your browser's JavaScript engine. The data never leaves the browser process.

Different tools use different browser APIs, each appropriate to the task:

• JSON formatting and validation — Uses the browser's native JSON.parse() and JSON.stringify() with CodeMirror for syntax highlighting.
• XML parsing and formatting — Uses the browser's native DOMParser API with text/xml MIME type for strict XML validation.
• Excel file generation — Uses SheetJS, a client-side library that constructs binary .xlsx workbooks in memory and triggers a download via a Blob URL — no server generates the file.
• Base64 encoding and decoding — Uses the browser's built-in btoa() and atob() functions.
• URL encoding and decoding — Uses encodeURIComponent() and decodeURIComponent().
• JWT decoding — Uses Base64Url decoding and JSON.parse() on the token segments, with no cryptographic verification that would require a server.
• Regex testing — Uses the browser's JavaScript RegExp engine — the same one running your application code.
• CSV deduplication — Uses JavaScript's Set data structure for O(n) deduplication, entirely in memory.

None of these operations require a network call. The architecture means you can use every tool here on an air-gapped machine, with your browser's network access blocked, and every tool will work identically. Load the page once, disconnect from the internet, and format JSON all day. That is how local the processing truly is.

What makes this different from other tools

Most popular developer tools — JSONFormatter, CodeBeautify, and similar platforms — send your data to their servers. This is not speculation: it is how server-side rendering works. When you click "Format" and the page updates, your data made a round trip to a server. That server logged the request. That log may be retained for 30, 60, or 90 days. The terms of service may or may not cover what happens to that log data. You will never know for certain, because you cannot observe what happens on someone else's server.

The difference with Status202 is not a policy difference — it is an architectural difference. Because there is no server involved in data processing, there is nothing to log. A server cannot leak data it never receives. The privacy guarantee is enforced by the design of the system, not by a promise in a privacy policy. You can verify it is working correctly every single time you use a tool, using the DevTools Network tab — a standard browser feature you already have. No trust required.

Status202 is built and maintained by a developer who works with sensitive data every day and got tired of choosing between convenience and security. The tools are free, and they will stay free. The only revenue comes from the non-intrusive display ads on the site — ads that are clearly labeled and have no access to your tool data. Your data and the ad system are completely separate. That separation is by design, and it will not change.