The conversion boundary is your browser.

The shared interface loads with the page. To keep that first download small, some format-specific parser and converter modules load as static JavaScript chunks from this site when you first use the format. After the module is available, pressing Convert calls its local functions directly; you can disconnect and continue using that tool for the rest of the tab's session.

Some browser capabilities—such as clipboard permission, downloads, and local file access—still require an explicit user action. None of them routes conversion content through a ConvertJSON.io server.

The site intentionally has no payload share URL. Inputs do not enter query strings, route segments, or fragments, so browser history, copied addresses, referrer headers, and indexable pages cannot accidentally become a payload transport.

Swap between paired tools uses temporary sessionStorage on the same device and removes the value as soon as the destination reads it.

Pageview analytics still run, and privacy-safe product events report whether a conversion succeeded, failed, was copied, downloaded, or used a formatting preset. A typed allowlist reduces every event to a tool ID, stable category, optional mode or preset, and coarse size bucket.

No input, output, raw parser message, filename, selected text, or clipboard value is accepted by that event boundary. See every event and property.

A browser extension, compromised device, shared screen, clipboard manager, or malicious third-party script can still expose data on your machine. Use redacted samples for secrets and customer data, keep your browser updated, and inspect unfamiliar tools before pasting credentials.

JWT decoding is particularly easy to misunderstand: displaying claims is not signature verification and says nothing about whether a token should be trusted.