Security

Security and privacy for browser-based developer tools

MyDevTools is built around a simple principle: keep local work local where possible, and encrypt sensitive synced data before it leaves the browser.

What runs locally

Formatter, parser, converter, and generator workflows are designed to run directly in the browser whenever the tool does not need a network service.

  • JSON formatting, Base64 encoding, UUID generation, and similar operations avoid server round-trips.
  • Tools that connect to external services, such as API or database clients, necessarily send requests to the targets you choose.
  • The help docs explain tool-specific data behavior for sensitive workflows.

Encrypted sync

Sensitive persisted data such as vault-style records is encrypted in the browser before sync.

  • The server stores ciphertext and metadata required for sync, not readable vault plaintext.
  • Your master password is not transmitted for vault unlock flows.
  • Self-hosting lets you control the backend and storage environment.

Honest limits

Security depends on the browser, the deployment, and the external services you choose to connect.

  • Do not paste highly sensitive production secrets into tools you do not control.
  • Use self-hosting for regulated, internal, or highly sensitive workflows.
  • Review the open-source code and deployment configuration before team-wide adoption.