First, the scope, stated precisely, because the title earns its keep only inside it. This estate runs two free-tool shelves: Developer Labs, which its own articles already cover, and the newer free-resources shelf — a JWT decoder, a regex tester, a JSON formatter, a markdown previewer, a CSS/JS minifier, and an image optimizer. This piece is about that second shelf, and its claim is exactly this: the six tool scripts contain no network primitive of any kind. What you paste, type, or drop into them is parsed in your tab and is never transmitted. Not the claim every tool page makes — “your data never leaves your browser” — because that sentence, unqualified, would be false here: the pages around the tools load fonts, icons, engines, and analytics like most pages on the modern web, and a reader with the Network panel open would catch the difference in ninety seconds. So this article does what a promise can't: it hands you the receipt for the true claim, and the full inventory of the rest.
The Claim, Sized Exactly
The six scripts total 1,592 lines — recounted the morning this published (283 for the JWT decoder, 201 for the regex tester, 334 for the JSON formatter, 148 for the markdown previewer, 263 for the minifier, 363 for the image optimizer) — and a word-boundary audit across all of them, re-run the same morning, finds zero of every way a browser script can transmit: no fetch(, no XMLHttpRequest, no sendBeacon, no WebSocket, no EventSource, no dynamic import(. There is no “anonymized telemetry” carve-out hiding in a footnote, because there is no code that could carry it.
Two lines in the audit look like near-misses and resolve local, and naming them is cheaper than letting a skeptic find them. The image optimizer assigns img.src from a FileReader result — a data URL built from your own file in memory, not a request; its previews use object URLs, same story. And the regex tester spins up a Web Worker built from a Blob whose source is a string inside the file itself — its three postMessage calls are messages between your tab and your worker, not the network. The worker exists for a reason worth knowing: your pattern runs off the main thread, so a catastrophic-backtracking regex gets killed by a timeout instead of freezing your tab. One more precision, because “never sends” and “never keeps” are different promises: two tools retain things on your machine — the JSON formatter remembers your indent preference, and the markdown previewer autosaves your draft to localStorage so a closed tab doesn't eat your work. Stored locally; transmitted never.
The Ninety-Second Receipt
Don't trust us — run this
Open any tool on the shelf. Press F12 for DevTools, pick the Network tab, filter to Fetch/XHR, and click Clear. Now paste something with stakes — a made-up JWT, a gnarly regex, a blob of JSON (invent it; never test with a production secret, here or anywhere) — and run the tool. Watch the panel. Zero new rows. Decode, format, minify, optimize to your heart's content: the request count stays where you left it, because the code that could move it doesn't exist. That's the whole receipt, reproducible by anyone, on the actual page, without trusting a word we wrote.
What You Will See at Load — All of It
Now clear the filter and reload the page, because the honest half of this article is that the panel is not empty at load, and you deserve the inventory before you find it yourself. Every one of the seven pages on this shelf — the six tools and the index — contacts cdn.jsdelivr.net when it loads. Two different reasons, worth separating. Three tools pull their engines from that CDN: the markdown previewer loads marked, DOMPurify and highlight.js; the minifier loads csso and terser plus jszip for batch downloads; the image optimizer loads jszip (its PNG codecs are first-party files). And all seven pages — including the three whose engines are entirely inside their own 1,592 audited lines — pull the Font Awesome icon stylesheet from the same host. All seven also load Google Fonts. What does a CDN learn from that? Your IP address and which page you opened — the same thing any static-asset host learns. What it never sees is your input, which does not leave the tab.
Then the first-party load-outs, named plainly. Every page loads our consent banner script (third-party trackers fire only behind consent), a config script, and the components loader — which also injects our first-party funnel analytics unconditionally: page-level usage signals posted to api.wigleystudios.com and nowhere else, classified in the code's own comment as strictly-necessary site analytics, separate from the consent-gated trackers. And one thing on these pages genuinely sends what you type, so it gets its own bolded sentence: the testimonial form. Fill it in and submit, and it POSTs your name, email, company and message to our API — that's what a form is. It sends nothing until you do, and the tools' input path never touches it. An article titled “never send anything” that hid a form asking for your email would be running the exact con this shelf exists to refuse.
What the CDN Dependency Costs
The Trade, Stated Twice Because It's Two Trades
Block cdn.jsdelivr.net at your firewall and two different things happen on this shelf. The markdown previewer, the minifier, and the image optimizer lose their engines — those three degrade or die, because their heavy lifting ships from the CDN. The JWT decoder, regex tester, and JSON formatter keep working — their engines are the audited lines themselves — but all seven pages lose their icons, and every page still attempted that one CDN request. So never read this article as “the tool pages touch jsdelivr not at all”; the accurate sentence is that your input never goes anywhere, while the page fetches its wardrobe from the usual places. If your threat model requires zero third-party requests at load, this shelf isn't that — and we'd rather tell you than have your Network panel do it.
Two Shelves, One Rule
Why two free-tool shelves at all? Developer Labs is the app-shaped shelf — Brand Token Studio, API Contract Lab, Mock Data Lab — with its own pages and its own prior write-ups. The free-resources shelf is the utility drawer: the six small tools you reach for mid-task, precisely the moment you're most likely to be holding something sensitive — a token from the wrong environment, a customer's JSON, a regex against production logs. Different shelves, one house rule shared by both: the work happens in your browser, and the receipt is checkable. The reason a shelf like this comes from a Shopify-app shop is the same reason our apps hold no order or customer scopes and our products list what they won't claim: the cheapest data to protect is the data that never arrives. It's also, not coincidentally, where a lot of software is quietly heading.
The Drawer Is Open
Six tools, no accounts, no uploads, and a Network panel that will back up every sentence above. Bring your own made-up token.
Open the Free Resources Shelf