DEV Community: Kaewkamphon Suesirithamrong

Does your online dev tool upload your data? Check in 30 seconds

Kaewkamphon Suesirithamrong — Thu, 15 Oct 2026 06:55:04 +0000

You paste JWTs, configs and logs into online tools every day. Do you know where they go?

The 30-second check

Open the tool, press F12 → Network, and clear the list.
Paste fake input and run the tool.
Click any new request → Payload. See your input? It left your machine.

💡 Bonus: click the page itself and find content-security-policy in the response headers. connect-src 'self' means the page can only talk to its own site. Not proof, but a good sign.

Jobs that should pass this check

None of these need a server:

🔒 Redacting a log before you paste it into an AI
📂 Diffing two config files
✅ Verifying a download's SHA-256
🖼️ Turning an image into a data URI

ERROR payment failed for jane.doe@example.com from 203.0.113.42
→ ERROR payment failed for [EMAIL_1] from [IP_1]

I build DevTrove, where all four run in your browser. Go ahead and run the check on it. 😉

Which tool are you checking first? 👇

Built and written with help from AI, reviewed and tested by me.

A JSON Schema validator that runs in your browser and never downloads your $refs

Kaewkamphon Suesirithamrong — Wed, 14 Oct 2026 04:29:24 +0000

When I validate JSON against a schema, the data is often something I'd rather not paste into a random website: API responses, config files, payloads from work. So I built a JSON Schema validator that runs entirely in the browser, as part of DevTrove, my set of privacy-first developer tools.

👉 JSON Schema Validator

What it does

Paste a schema on one side and JSON data on the other, then press Validate (or Ctrl/⌘+Enter). You get either Valid or a list of errors. Each error shows:

where it is in your data, as a JSON Pointer path like /users/0/email;
what is wrong and which keyword failed;
where that keyword sits in the schema.

It supports Draft 2020-12 and Draft-07. The version comes from $schema, or from a Draft selector if the schema has none. Other drafts are rejected instead of being checked with the wrong rules.

Three things I cared about

1. Nothing leaves the page. The schema and the data are not uploaded, not stored and not put in the URL. Validation runs in a Web Worker, which is stopped after 5 seconds, so a pathological regex can't freeze the tab.

2. $ref is never fetched. References are resolved only inside the schema you paste (#/$defs/..., $id, $anchor, $dynamicAnchor). A reference to another URL is reported as an error rather than downloaded. If you need another schema, copy it under $defs. The official 2020-12 and Draft-07 metaschemas are built in.

3. Numbers are compared exactly. JavaScript reads 9007199254740993 and 9007199254740992 as the same number. This validator compares decimal values exactly, so the schema { "maximum": 9007199254740992 } rejects the data 9007199254740993, as it should. Likewise 1.0000001 is not a multiple of 1, and 0.30000000000000001 is not equal to 0.3.

Honest limits

format (email, date-time, …) is treated as an annotation, the 2020-12 default, so it is not checked. The page tells you how many format keywords it skipped.
Input is strict JSON: no comments or trailing commas, and duplicate keys are rejected.
Each box takes up to 1,000,000 characters.
I've tested it in Chromium-based browsers. Firefox and Safari aren't verified yet.

Try it

It's free, needs no sign-up, and has a Load example button if you just want to see it work:
https://dev-trove.com/tools/json-schema-validator

If you find a schema it gets wrong, I'd like to hear about it in the comments.

I built a set of developer tools that run entirely in your browser

Kaewkamphon Suesirithamrong — Tue, 13 Oct 2026 10:23:42 +0000

I kept pasting JWTs, JSON with real customer data, and config files into random online tools, and never knew where that data went. So I built DevTrove: https://dev-trove.com

What it is

22 free developer tools: JSON formatter and validator, JSON Schema validator, JSON semantic diff, YAML ↔ JSON, CSV ↔ JSON, JWT decoder and encoder/verifier, Base64, URL and HTML encoding, hash and password generators, a regex tester, a cron explainer, a timestamp converter, and more.

How it handles your data

Your input is processed in your browser. Tools don't send it to a server, store it, or put it in the URL.
No analytics, no ads, no sign-up.
Heavy tools (regex, YAML, JSON diff and schema validation) run in a Web Worker with a timeout, so a catastrophic regex can't freeze the page.
The JWT tools use the Web Crypto API, reject alg: none, and enforce minimum HMAC key lengths.

Stack

Next.js, React, TypeScript. Each tool has unit tests and Playwright end-to-end tests, including accessibility checks on desktop and mobile.

I'd love feedback

Which tool do you reach for that's missing?
Anything that feels slow, confusing, or broken on your device?

Thanks for reading!