Short answer: it is safe only when the tool processes your input entirely in your browser and never transmits it. Many online tools do send what you paste to a server, and from the page alone you cannot tell what that server logs, caches or keeps in backups. The good news is that checking takes about thirty seconds.
Why it matters
API keys, JWTs, session cookies and webhook secrets are bearer credentials: whoever holds one can use it. Pasting a live credential into a tool that posts it to a server means:
- the request may be written to access logs, error trackers and analytics;
- the value may persist in backups long after the page is gone;
- anyone who compromises that server — or works there — can read it.
For a JWT, that is a working session until it expires. For an API key, it can be months. Security teams treat a credential that has been sent to an unknown third party as compromised, and rotate it.
How to check any tool in thirty seconds
You do not need to trust a privacy policy. Test the tool directly:
- Open the tool and let the page finish loading.
- Open your browser's developer tools (
F12orCmd+Option+I) and select the Network tab. - Clear the list, then paste a fake value — never a real one for this test — and use the tool.
- Watch for new requests. If one appears whose payload contains your input, the tool is server-side.
- For a stronger test, switch DevTools to Offline and try again. A genuinely client-side tool keeps working with no network at all.
Every tool on apikey.tools passes this test: they use the browser's built-in Web Crypto API and crypto.getRandomValues, so there is no server to send anything to. How it works explains exactly what runs where.
Which tools are low risk and which are not
| Task | Can it run entirely in the browser? | What to look for |
|---|---|---|
| Generate an API key or secret | Yes | Uses crypto.getRandomValues, not Math.random |
| Decode or verify a JWT | Yes | Works offline |
| HMAC, SHA-256, MD5 hashes | Yes | Works offline |
| Base64, hex, URL encoding | Yes | Works offline |
| Identify which service a key belongs to | Yes | Matches by pattern locally |
| Check whether a key is still *valid* | No | Requires calling the provider — never paste a live key into such a tool |
| One-time "burn after reading" secret links | No | Requires a server to store and delete the secret |
The last two rows are the honest exceptions: any tool that claims to validate a key against a provider, or to host a secret for later retrieval, must send it somewhere. Use those only with services you already trust.
Safer habits regardless of the tool
- Prefer test credentials. When you are debugging a format or a signature, a test-mode key or a token from a development environment carries no risk.
- Redact before you share. The secret masking tool keeps enough of a key to identify it without exposing it.
- Decode locally when in doubt. A JWT payload is just Base64URL:
echo "$PAYLOAD" | base64 -don the command line gives you the claims with no website involved. - Use short-lived tokens. A JWT that expires in fifteen minutes limits the damage of any exposure, through a tool or otherwise.
If you already pasted a real key somewhere
Assume it is exposed and rotate it. Identify the provider with the API key detector, revoke it with the revocation command generator, and follow the leaked API key checklist to check whether it was used. Rotating a key takes minutes; investigating an abused one takes much longer.
Frequently asked questions
Is it safe to paste a JWT into an online decoder?
Only if the decoder runs entirely in your browser. A JWT is a live credential until its exp time, so a decoder that sends it to a server exposes your session. Check with the Network tab or by going offline; the apikey.tools JWT decoder works fully offline.
Are online API key generators safe?
A generator is safe when it creates the key in your browser with crypto.getRandomValues and never transmits it. A server-side generator could log every key it hands out. The apikey.tools random API key generator generates keys locally and works offline.
How can I tell if a website uploads what I type?
Open the browser's developer tools, go to the Network tab, type a fake value into the tool and watch for requests containing it. Then switch to offline mode: a tool that keeps working without a network connection cannot be sending your input anywhere.
Is a client-side tool completely risk-free?
No tool removes every risk. A malicious browser extension or compromised device can read anything on any page, and the clipboard is shared with other applications. Client-side processing removes the server from the picture — the largest and least visible risk — but normal device hygiene still applies.