Web-based developer tools can make everyday tasks—formatting JSON, converting data, encoding text, or testing regular expressions—quick and convenient. But when a tool processes input on a remote server, that input may leave the browser. For developers working with sensitive material, it is useful to understand what network activity occurs while a tool is in use.
This case study examines seven utilities in the KivaroTools developer tools directory. The site describes its tools as processing inputs locally. To observe their behavior in a browser, I ran an automated test using Headless Google Chrome and the Chrome DevTools Protocol (CDP).
Audit method
The audit used Headless Google Chrome v155.0.8059.80 on October 21, 2026. Each utility was given a harmless, unique test input. The test monitored captured browser network events—including Fetch, XHR, beacons, WebSockets, and asset requests—during page load and tool interaction. It also checked whether the unique input strings appeared in captured request data.
The initial page loads generated requests for resources such as HTML, JavaScript, CSS, and icons. The audit report also recorded sitewide analytics or telemetry activity during page load. The interaction results below refer to the subsequent tool actions, not to the initial page loads.
Results
| Utility | Test input | Observation during interaction |
|---|---|---|
| JSON Formatter | {"audit_live": "test_json_kivaro_99"} |
No new outgoing requests observed; test string not found in captured traffic. |
| SVG Optimizer | <svg id="audit_live_svg_kivaro_88"></svg> |
No new outgoing requests observed; test string not found in captured traffic. |
| Password Generator | A generated test password | No new outgoing requests observed. The generated value is not reproduced here. |
| JSON Converter | [{"audit_live": "csv_kivaro_77"}] |
No new outgoing requests observed; test string not found in captured traffic. |
| Base64 Encoder | audit_live_base64_kivaro_66 |
No new outgoing requests observed; test string not found in captured traffic. |
| SQL Formatter | SELECT * FROM audit_live_sql_kivaro_55 |
No new outgoing requests observed; test string not found in captured traffic. |
| Regex Tester | audit_live_regex_kivaro_44 |
No new outgoing requests observed; test string not found in captured traffic. |
Across the tested interactions, the report recorded no new outgoing network requests. It also found no test inputs in the captured request data. The report described the operations as running in the browser—for example, using client-side code for formatting and conversion, and the browser’s JavaScript engine for regular-expression matching.
What these results show—and what they do not
In this test session, the observed network activity occurred during initial page loads. No new outgoing requests were observed while the seven tools processed the test inputs. This is consistent with client-side processing under the tested conditions.
The finding is limited to this test session, browser build, and set of inputs. It does not establish that the tools will behave identically in every browser, configuration, or future version. Nor does the absence of a recognizable input string in captured traffic rule out every other possibility: data could be transformed before transmission, and this network test does not determine whether scripts or browser extensions can access page content locally. It is not a comprehensive security audit or a guarantee that sensitive information is safe to enter.
Reproducing the check
- Open a tool in Chrome and launch Developer Tools.
- In the Network tab, enable Preserve log and select All.
- Record the initial page-load activity. Then clear the log or mark where the interaction test begins.
- Enter a harmless, unique test string and run the tool.
- Check for new requests and search captured request data for the test string.
- Repeat for each tool, noting the browser version, date, and test inputs.
Use synthetic inputs for this check—not actual passwords, API keys, customer data, or other secrets. A browser network inspection can reveal some data transfers, but it cannot by itself establish that a website is secure.
Takeaway
The automated test reported no new outgoing network requests during interaction with these seven utilities, and the test strings were not found in captured traffic. That is a useful, bounded observation about their behavior in the tested session. Developers should treat it as one piece of evidence—not as a substitute for evaluating the tool, its implementation, and their own data-handling requirements.
Top comments (0)