safepaste

Free developer tools

Paste it. Read it. Nothing leaves your tab.

Small tools for the encoding and decoding that fills a working day. They run in your browser, they have no way to send what you paste anywhere, and there is nothing to sign up for. No advertising, no analytics, no accounts.

Open the base64 tool

The tools

One job each, done properly.

Each tool is its own page on its own subdomain, and each one is a single self-contained file. Save one to disk and it keeps working with no network at all.

Base64 base64.safepaste.dev

Encode and decode in either direction. Paste anything and it works out which way you meant, reads data URLs, handles the URL-safe alphabet, and tells you what the bytes turned out to be.

Ready
JWT jwt.safepaste.dev

Read the header and claims of a token, with the expiry worked out in your own time zone. Signatures are read, never verified, because verifying one needs a key.

Not built yet
URL encoding url.safepaste.dev

Percent-encoding both ways, with query strings pulled apart into their parameters and put back together again.

Not built yet
Hashes hash.safepaste.dev

SHA-256 and its relatives, over text or over a file you drop in, computed by the browser's own cryptography.

Not built yet
JSON json.safepaste.dev

Formatting, minifying, and an error message that points at the character where the document stopped making sense.

Not built yet
Timestamps time.safepaste.dev

Epoch seconds, milliseconds and ISO 8601, converted between each other and into whatever your machine thinks the time is.

Not built yet

Why bother

The things you paste into a converter are not harmless.

A token, a config file, a customer record, a response body from a system that is misbehaving. People paste all of it into whatever page a search turns up, and that page is usually funded by advertising.

The browser enforces it

Every page ships connect-src 'none', which makes fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon fail at the browser level. Not by convention. By policy.

The build checks it

Policy cannot disable everything, so the build rejects the rest: WebRTC, programmatic navigation, service workers, and every form of browser storage. It then inspects the finished file and refuses to publish one that has stopped being self-contained.

Nothing is remembered

No cookies, no local storage, no session storage, no IndexedDB. There is no account to make and no preference to save. Close the tab and there is nothing left behind.

Do not take our word for it

Check it yourself in about a minute.

  1. Open a tool, then open your browser's developer tools.
  2. Switch to the Network tab and reload the page.
  3. Paste something in and use it. The list should show the document itself and nothing else, however long you keep going.
  4. While you are there, look at View Source. The policy is in the head of the page and the whole application is in the same file.

These are free, and they stay free.

There is no paid tier and nothing is being upsold, because the moment a tool like this has a business model built on attention, the incentives point the wrong way. If they save you some time, you can put something towards the hosting.

Support SafePaste

What happens to what you paste

Nothing. Every SafePaste tool converts what you give it inside your own browser tab, and then it is gone when you close the tab. There is no account, no database and no analytics, so there is nothing for it to be stored in.

This is enforced, not promised

Every page in the network ships a Content Security Policy of connect-src 'none'. That makes fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon fail in the browser itself, whatever the code on the page tries to do. Images and fonts are restricted to data that is already inside the file, and form-action 'none' closes form submission as a way out.

The build separately rejects the capabilities that policy cannot reliably disable, including WebRTC and programmatic navigation, and then checks the finished file. It also fails if a page gains localStorage, sessionStorage, IndexedDB, a cookie or a service worker, so the claim that nothing is remembered stays true by construction rather than by good intentions.

What the host can see

These pages are served by Cloudflare Pages. Like any web server, it sees the request for the page itself: an IP address, a user agent, a timestamp. That happens before any of the page's own code runs, and it is the same for every website you visit. What it does not see is anything you paste, because nothing you paste is ever part of a request.

No cookies, no storage, no trackers

The links that leave

The footer links to Flytrap Industries, and the page offers a Stripe donation link. Neither is contacted unless you click it. They carry no query string and no referrer, so following one tells the destination nothing about what you were doing here. If you do donate, Stripe handles that payment under its own privacy policy and SafePaste never sees your card details.

Working offline

Save any tool to disk and open it again. Each one is a single self-contained file, so it works with no network at all, including on a machine that has never been connected to one.

This policy describes the pages it is part of. It ships inside them, so the copy you save to disk carries it too.