DEV Community: Format stack

Don't trust my "client-side only" claim. Open DevTools and check.

Format stack — Mon, 31 Aug 2026 04:39:00 +0000

Carhartt just had 12.9 million customer accounts show up on Have I Been Pwned. Names, emails, phone numbers, physical addresses — all pulled by an extortion group that says it grabbed the data back in August. Manchester Airports Group had a similar week: Wi-Fi signup data across three UK airports, gone.

Neither of those companies got breached because a user pasted something into a sketchy tool. They got breached because they stored data server-side, and storage is a standing liability — it sits there waiting to be exfiltrated. But those headlines are exactly why "we don't store your data" claims from random web tools are worth being skeptical of, not trusting. Every JSON formatter, regex tester, and Base64 decoder on the internet says some version of "your data never leaves your browser." Most of them are telling the truth. Some aren't. You have no way to know which, unless you check.

So here's the actual check, using FormatStack as the example, since it's the one I can show you the source for.

The claim

FormatStack's tools — JSON formatter, regex tester, UUID generator, Base64 encoder/decoder, cron parser — run entirely in-browser. No framework, no build step shipping your input to a server, no API call carrying your pasted content anywhere.

The proof, not the promise

Anyone can write "processed locally" in a footer. Here's how to verify it takes about 30 seconds and works on any tool claiming client-side processing, not just this one:

Open the tool in your browser.
Open DevTools (F12 or Cmd+Option+I), go to the Network tab.
Clear the log, then paste in something identifiable — a fake API key, a made-up email, whatever you'll recognize.
Run the formatter/parser/whatever the tool does.
Watch the Network tab. If your pasted content is client-side only, you'll see zero new requests carrying that payload. Analytics pings may fire (page views, button clicks) — that's expected and disclosed — but none of them will contain your input.

If instead you see a POST request firing off to some API right after you paste, with your input sitting in the request body — that tool is not doing what its marketing copy says, regardless of what the footer claims.

Why I'm not hiding the parts that do send data

FormatStack runs Google Analytics and AdSense. Both of those make outbound requests. I'm not going to pretend otherwise — that would be the same category of lie as a tool that silently uploads your JSON. The distinction that actually matters, and the only one I'm claiming, is narrow: analytics tracks that you used the tool; nothing tracks what you put into it. Open the Network tab and you'll see the difference — GA calls carry event names and page paths, never your pasted payload.

That's a smaller claim than "we don't track anything," and it's also the only one that survives someone actually checking.

The takeaway

Breach news cycles every few weeks because storage is a liability regardless of intent — good security practices reduce risk, they don't eliminate the fact that stored data can eventually leak. The tools that can't leak your pasted content are the ones that never had it to lose. But don't take my word for that either. Open the tab. Check.

Every dev tool you paste your data into is a potential breach you didn't sign up for

Format stack — Tue, 25 Aug 2026 06:06:07 +0000

This week another headline dropped: a threat actor is reportedly selling around 3.6 million employee records lifted from Microsoft Azure environments across multiple Fortune 500 companies. It's not an isolated story — breach-tracking groups are on pace to blow past last year's record for reported data compromises, and a big chunk of that volume is coming from third-party exposure: not the company you trust, but some tool or vendor sitting quietly in the middle of your workflow.

That third-party category is worth sitting with if you're a developer, because it includes a tool most of us use constantly and think about the least: the random online JSON formatter, regex tester, or Base64 decoder we paste real data into to debug something at 11pm.

Think about what actually goes through those tools. API keys. Auth tokens. Chunks of production payloads. Customer data you're trying to reformat for a bug report. Most of us don't stop to check whether the site we just pasted that into is logging it, storing it, or shipping it to a third-party server for "analytics." It's just a formatter. It feels disposable. It isn't.

That's the exact problem I built FormatStack to not have.

No server round-trip for your data, full stop. The JSON formatter, regex tester, UUID generator, Base64 encoder/decoder, and cron parser all run entirely in your browser — plain JS, no framework, no backend call carrying your pasted content anywhere. What you paste never leaves your machine. Not "we don't log it" (a policy, which you have to trust) — it architecturally can't leave, because there's no endpoint for it to go to.

Given how much this year's breach numbers are increasingly driven by data sitting somewhere it didn't need to, "the data just never leaves your browser" isn't a nice-to-have. For a debugging tool, it's the only architecture that actually makes sense.

If you want to see it or check the claim yourself: formatstack.tech

We Can't See What You Paste — And That Was a Design Constraint, Not a Slogan

Format stack — Thu, 20 Aug 2026 05:01:53 +0000

We can't see what you paste. No logging. No uploading. Just your browser.

That's not marketing copy I wrote after the fact — it's a description of how FormatStack is actually built. Every tool (JSON formatter, regex tester, UUID generator, Base64 encoder, cron parser) runs entirely client-side. When you paste something in, it never leaves the tab. There's no fetch(), no API route, no server that ever sees the payload — because there isn't a server in that request path at all.

I want to be precise about what that claim covers, because vague privacy claims are exactly what a dev audience should be skeptical of.

What "we can't see what you paste" actually means: The processing — parsing, formatting, encoding, whatever the tool does — happens in your browser's JS engine. Your input never becomes a network payload. That's an architectural fact, not a policy I could quietly change. There's no backend endpoint to add logging to even if I wanted to.

FormatStack is live at formatstack.tech.

Why I Built 5 Developer Tools That Never Talk to a Server

Format stack — Wed, 19 Aug 2026 04:47:29 +0000

Every JSON formatter, regex tester, and Base64 tool I could find online works the same way: you paste your data in, it gets sent to a server, and you get a result back. For a throwaway public snippet, that's fine. For an API response with real customer data, an internal config file, or a token you're debugging at 2am — you've just handed that to a server you know nothing about.

That bugged me enough to spend time building the alternative: FormatStack, five utility tools that run entirely in your browser tab. Nothing you paste in is ever transmitted anywhere.

What's in it
JSON Formatter — pretty-print, minify, validate with real parse errors
Regex Tester — live match highlighting, capture groups, common presets (email, URL, phone, IP)
UUID v4 Generator — single or batch, via crypto.randomUUID()
Base64 Encoder/Decoder — proper UTF-8 handling (plain btoa() breaks on emoji and accented text — more on that below)
Cron Parser — plain-English translation plus next 5 run times, computed locally.

FormatStack is live at formatstack.tech.