What do you paste into a formatter that you'd never want uploaded?
by•
I built PasteKit because I kept pasting API responses, JWTs and customer exports into online formatters, then wondering where that data went.
PasteKit formats and converts everything locally in your browser. Nothing is uploaded, and it works offline after your first visit.
I'm curious: what's the most sensitive thing you've pasted into an online tool? And what would make you trust a formatter with it?
61 views
Replies
I've definitely used online tools for debugging without thinking much about where the data goes. A clear explanation of what stays local would make me trust a tool like this more.
JWTs and raw API responses from production are the big ones, since both tend to carry tokens or customer data. For me "local only" claims need to be verifiable: a strict Content-Security-Policy with no outbound connect-src, working with the network tab open and nothing firing, and ideally a version you can run fully offline. If the page can prove it can't phone home, I'd trust it.
Customer exports feel like the riskiest paste, since one CSV can hold names and emails in every row. Does PasteKit stay quick on really big files?
Webhook payloads from production for me, they carry customer emails and payment details. The thing that would earn my trust.. open the network tab, paste, and see zero requests after the page loads. A test I can run myself in ten seconds beats any promise on a landing page!
Client API responses, almost always.
I'm freelance, so most of what I'm debugging belongs to someone else. A staging response is never just a shape — it carries the bearer token I pasted along with it, a customer's email in the body, internal IDs that map to real orders. None of that is mine to hand to a third party, and the client never agreed to it either.
The one that made me stop was a payment webhook payload. I caught myself about to paste it, thought about how I'd explain that if anyone ever asked, and closed the tab instead.
What's strange is that the risk is invisible at exactly the moment it matters. The formatter works. Nothing bad appears to
happen. You'd only find out years later, if ever.
On your second question — what would make me trust one: beingable to pull the network cable and have it still work. Not a policy page, not a badge. Load it, go offline, watch it format anyway. That's the only claim a user can check for themselves, and you've already built it.