What Not to Paste Into Online Developer Tools

This is not “never use a website.” It is “know which paste is a secret.” DevOkk’s encoding and JSON pages are built to finish in the browser so the safer default exists. They are not a vault. A shared laptop, a screen share, and a Slack screenshot still leak.

The strings that are really credentials

Access tokens and JWTs. Bearer tokens in Authorization headers are often enough to call an API until they expire. JWT payloads add emails, tenant IDs, and scopes on top. Decode locally with JWT Decoder. Do not put a production HMAC secret into jwt.io to “just check the signature.” Decode vs verify is What is a JWT?. Site choice is jwt.io vs a browser JWT decoder.

API keys, Authorization basic headers, and .env lines. If it would rotate after a GitHub leak, it does not belong in a beautifier. Hashing the key to compare two values can be done with Hash Generator locally. Pasting the key into a “hash online” site to get MD5 of a production secret is how incidents start. MD5 is not how you store passwords anyway - MD5 vs SHA-1 vs SHA-256.

Refresh tokens, session cookies, and magic-link URLs. Same class as access tokens. A URL with token= in the query is not “just a link.”

Private keys. PEM blocks, SSH keys, PKCS files. There is no legitimate “pretty-print my private key on a website” workflow. Use OpenSSL or an editor on disk.

Customer dumps. JSON or CSV with emails, addresses, health data, or card-adjacent fields. The syntax error is in your process. Redact, then lint. JSON Formatter locally is the remaining option if you still need a browser.

The strings people think are hidden

Base64. Not encryption. Anyone decodes it. Base64 Encoder is for data URLs and debugging, not for hiding an API key in a config you will commit. If the decoded value is a secret, the encoded value is the same secret in costume.

URL encoding. URL Decoder turns %2F into /. Query strings often contain tokens. Decode locally. Do not paste a full signed URL from a private bucket into a random decoder and then paste the result into a ticket.

HTML entities. HTML Encoder is for markup, not confidentiality.

Minified JSON. Compact is not secret. Minify with JSON Minifier after you have decided the payload is allowed to exist on that machine.

Passwords and “check my password” sites

Two different pages:

Generate. Password Generator should create a new random string in the page. Use a password manager to store it. Generating on a website is still a choice; local generation is the default that matches DevOkk’s model.

Strength. Password Strength Checker is a heuristic. It is not Have I Been Pwned unless the page says it queries that API - and if it does, you are sending a hash or the password depending on the implementation. Read the page. Never type your current email password into a tool you found in an ad.

If you must test a candidate password, test a new candidate, then store it in the manager. Do not “check” the password you already use for the bank.

What is usually fine to paste

• Public JSON from documentation
• A dummy JWT from a tutorial (sub":"user1")
• A hash of a file you already published (checksums)
• Lorem, sample regex, a color hex
• A hostname for DNS/SSL that you are allowed to probe - those tools must send the name; see How DNS records work

“Fine” still includes the usual website risks: the page loads third-party scripts, you have sketchy extensions, someone is looking over your shoulder.

A table you can keep next to the monitor

Paste	Default	Why
Live JWT / session	Local decoder or don’t	Bearer credential
API key / PEM	Disk / vault only	Rotation event if leaked
Production JSON with PII	Redact, then local formatter	Customer data
Dummy JSON / docs sample	Any lint/formatter	Not a secret
Current account password	Never	Phishing-shaped
New generated password	Local generator + manager	Still don’t reuse
Public docs URL / blog HTML	Fine	Public
Internal hostname	Only if you own it	Network tools send it

HAR files, ChatGPT, and other paste magnets

HAR and Charles/Fiddler exports. These are not “a JSON error.” They are a recording of a session. Treat them like a password dump. Store them on disk, grep locally, delete them. Do not drop a HAR into a formatter website to pretty-print the whole capture.

Pasting into ChatGPT, Claude, or a ticket bot. The same rules apply. A model vendor is another third party. Redact, then ask “why is this JSON invalid” with a 20-line sample. “Here is our prod env” is not a prompt.

Source maps and .map files. They can contain original source and sometimes comments you did not mean to ship. Do not upload them to a random minifier to “inspect.”

Docker Compose and Kubernetes dumps. Secrets in env blocks. If you need to validate YAML, YAML to JSON locally after you replace the secret values.

QR payloads. QR Code Generator encodes what you type. Do not encode a live Wi-Fi password on a projector-connected laptop and leave the tab open. Test with a throwaway SSID if you are in a café.

Regex and “test this against production logs”

Regex Testing needs a sample string. Use a synthetic line that has the same shape, not a log line with a session ID and an email. The regex does not need the real PII to prove it matches.

How to still get the work done

1. Copy a slice. If the JSON error is at the start, you do not need the 8 MB export. Paste the first object.
2. Replace secrets with placeholders. "token":"REDACTED" still lints.
3. Use a local tab. JSON Formatter, JWT Decoder, Base64 Encoder, Hash Generator.
4. Prefer an editor when the file is already on disk.
5. Clear the field on a shared computer. Close the tab. Do not leave a token in undo history on a demo laptop.

The file-side companion is A practical privacy checklist before you share a file. The encoding map is Best free security and encoding tools.

What “the tool is open source” does not buy you

A GitHub repo for a formatter does not mean the website you typed is running that commit. Supply-chain attacks on popular utility domains have happened in the industry. Bookmark the origin. Prefer local processing so a compromised server never receives the secret even if the JS is hostile - hostile JS in your tab can still read the paste, which is why extensions and shared computers remain in the threat model.

Client-side is a reduction of vendor copies, not a reduction to zero.

After a paste you should not have made

Rotate the token or password. Assume it was copied. Check access logs. Do not “hope the site is honest.” The time to read a privacy policy is before the paste, not after.

If the paste was a customer file, follow your incident process - the same as a lost USB stick. A formatter website is not a special category of “not a breach.”

Support tickets with pasted tokens are the same class. Redact the ticket. Rotate. Local decode was available the whole time at JWT Decoder.

UUIDs, public documentation URLs, and CSS color values are not in this article’s danger list. If you are unsure, ask whether you would rotate the string after a GitHub leak. If yes, do not paste it into a website to format it.

Checksums of public downloads (SHA-256 of a Linux ISO) are the opposite case: hashing them on any correct implementation is fine. The secret is when the input is private, not when the algorithm is SHA-256.

Paste buffers on a shared demo laptop survive tab close in surprising ways. Clear the field. Copy something innocuous over the clipboard. Reboot if the machine is not yours.

Incognito is not a security boundary against a website you pasted into. It only drops local history.

Online developer tools are safe when the paste is not a secret. They are a habit hazard when the clipboard is a production header. Keep the credential in the tab you control, or keep it off the web entirely. The formatter will still tell you about the comma.