TL;DR: Many browser tools process what you paste inside the page and do not need an account. That is not a promise that nothing leaves the machine. Paste the smallest sample that proves the job, keep secrets out of one-off forms, and treat password helpers as generators and checkers, not as a vault.
Client-side is a design, not a magic word
“Runs in the browser” means the page can do the work with a script after it loads. A unit conversion, a color conversion, or a character count often has no reason to send your text anywhere. Other pages still load remote fonts, analytics, or a library from another host. A form can look local and still submit. You cannot see the difference from a marketing sentence. You can see it, if you care about a particular paste, by watching whether a click triggers a new request that contains your text. If you are not in a position to check, assume the cautious rule: do not paste secrets into a page you opened because it was convenient.
Masters Tool mixes lookups and transformers. A reference table receives little from you besides the fact that you loaded it. A converter receives the payload you paste. The payload is the sensitive part. The table of MIME types is not. Match your caution to what you are about to put in the box.
What never belongs in a casual paste
- Passwords, API keys, and tokens. A “test” key is still a key. Generate a fake string with the same shape if you only need to see how a formatter behaves.
- Customer data and private messages. Use a redacted sample or a synthetic paragraph.
- Unreleased source that your employer would not want on another machine. Format a toy snippet first if you are learning the tool.
- Medical details beyond the numeric inputs a health form actually requires. A lookup is not a diary.
- Government or payment numbers. No converter needs them to prove that Base64 works.
If the real payload must be converted, prefer a tool you run on your own computer for that one job, and use the website to learn the steps on dummy data. Convenience is a poor trade for a credential.
Password tools are a special case
The hub includes password-related helpers such as strength checks, generators, and hash utilities. A generator that creates a random string inside the page can be a reasonable way to get a candidate password, which you then store in a password manager, not in a screenshot. A strength meter judges the string you type. Do not type your real password into a meter on a website. Type a similar pattern of the same length and character classes, or use the meter built into your password manager. The meter’s opinion is not worth disclosing the secret.
A hash such as MD5 is a fingerprint of bytes, not encryption. It is not how you “protect” a password, and it is not reversible in any way you should plan on. People still paste a password into a hash box to compare fingerprints. That paste is a disclosure. If you are learning how hashes behave, hash a dictionary word you do not use for anything. If you are checking a file’s integrity, hash the file locally when you can. Do not invent a workflow in which a live password sits in a web form because the form was labeled with a hash algorithm.
Traces that remain after the result
Even a purely local script leaves traces you control: the browser history entry, the tab’s back-forward cache, and sometimes the field’s undo buffer until the tab closes. Close the tab when you finish. Do not leave a converter full of a client’s text sitting in the background while you share your screen. Check the URL. If the page puts your input into the query string so you can bookmark the result, that string can leak through history, screenshots of the address bar, and referrer headers. Prefer pages that keep the payload in the form body and out of the address.
Shared computers need a stricter habit. Use a private window, decline password-manager prompts that offer to store a non-password field, and sign out of any account that autofill might touch. Autofill is enthusiastic. It will offer a login to a box that asked for a sample sentence.
A practical privacy routine
Before you paste, ask whether a ten-line synthetic sample would teach you the same clicks. If yes, paste that. When the real data is ordinary and non-sensitive, such as a public color value or a unit conversion, stop worrying and do the job. Proportion matters. The goal is not to fear every calculator. The goal is to keep credentials and other people’s private text out of boxes that do not need them.
Clear the form when you are done if the page provides a reset, then close the tab. Do not bookmark a URL that contains the payload.
Use the hub with that filter in mind
Open ordinary converters from the Masters Tool homepage for public or synthetic input. Take secrets to a local program. The hub is a good place to learn a conversion and to run everyday numbers. It is not a vault, and it does not become one because the work happens to be done by a script in the page.
