Your data stays in your browser. These tools run entirely client-side. Tokens, PEMs, SAML payloads, Markdown source, and mock-response bodies are never sent to the Secutils.dev server in readable form. State that needs to survive a reload (or be shared) lives in the URL fragment (#…), which browsers never transmit to the server.
Short links. When you copy a short link, your browser encrypts the document and Secutils.dev stores only the encrypted copy, for the period you choose (1, 7, or 14 days). The decryption key exists only in the link, so the server can't read the document. Only the browser that created a link can delete it early. Your IP address is kept for one hour to rate-limit link creation.
Loading from a URL. When you use ?url= or the "Load URL" box, your browser fetches that address directly; the Markdown is read into the page client-side and is never relayed through the Secutils.dev server.
Map basemaps. GeoJSON and TopoJSON viewers fetch map tiles directly from OpenStreetMap. Tile requests reveal the displayed geographic area. Your Markdown source is not included.
Anonymous usage analytics. We use Plausible Analytics, a privacy-first, GDPR-compliant tool, to collect aggregate usage data. No cookies, no personal data, no individual tracking. The data is limited to top pages, referral sources, visit duration, and device-class metadata (device type, OS, country, browser). Full details in the Plausible Data Policy.
See the full Secutils.dev privacy policy for details on the wider service.