Local-first
Every tool here claims your text is never uploaded. That is easy to write and impossible to tell apart from a lie by looking at the page. So here is how to verify it yourself, in about a minute, using tools already in your browser.
Vague claims cannot be checked, so this one is narrow on purpose.
What you type into a Jamuny tool is never sent anywhere. No request carries it, because the work happens in the page you already downloaded. There is no backend to receive it, no account, and no log of your content — not because of a policy, but because nothing transmits it.
Not that your visit is invisible. Cloudflare serves these pages, so like any host it sees your IP address and which URL you asked for. Anyone claiming otherwise about a website they run is misleading you. The distinction that matters is between that you visited and what you typed.
In rough order of how convincing they are. The last one needs no tools at all.
The list stays empty. Decoding, verifying and signing produce no requests at all — measured, not asserted: zero outbound requests during all three.
Nothing third-party loads either. Every request the page makes is to this domain: the HTML, one stylesheet, the fonts. No CDN, no analytics, no tag manager. Fonts are self-hosted precisely because a request to Google Fonts would be a request carrying your IP to somebody else.
The JWT tool sets connect-src 'none'. That is a browser-enforced rule saying the page may not open any network connection — no fetch, no XHR, no WebSocket, no beacon. It is not a promise about what the code does; it is a constraint the browser applies regardless of what the code tries.
curl -sI https://jwt.jamuny.com/ | grep -i content-security-policyRead the connect-src value in the output. With it set tonone, a build that tried to send your token would simply fail to send it.
Load any tool, then turn off your Wi-Fi and keep using it. Decode a token, format some JSON, generate a hash, type into the notepad. Everything keeps working, because none of it needed the network in the first place.
This is the check that needs no technical knowledge and is the hardest to fake. Software that phones home stops working when it cannot.
Right-click and choose View Source on any tool page. What you get is the finished HTML — the text, the headings, the answers — not an empty shell waiting for a server. Turn JavaScript off entirely and the page still reads, because the content was never coming from anywhere else.
Local-first means the data is on your device, which is not the same as no data.
Documents are written to IndexedDB in your browser so they survive closing the tab. Per browser, per device — they will not appear on your phone.
Each keeps your most recent input in localStorage, so a stray reload does not lose a long list you had pasted in.
Clearing site data for the domain in your browser settings removes all of it, permanently and immediately. There is no copy anywhere else to delete.
You should not. That is the point. Every check below is something you run yourself against the live site — none of it depends on believing what is written here. If a check disagrees with a claim, the claim is wrong.
None that runs in your browser. There is no analytics script, no tag manager and no third-party request of any kind. Cloudflare serves these pages, so its own server-side logs record that a request happened, in the same way any web host knows it served you a page. Nothing measures what you do once the page has loaded.
That is not the claim, and it would be false. Cloudflare serves these pages, so like any host it sees your IP address and which URL you requested. What nobody sees is what you type into the tools, because that never becomes a request in the first place.
Nowhere, unless you save it. The notepad writes documents to IndexedDB in your own browser, and the converters keep your last input in localStorage so a stray reload does not lose it. Both are per-browser and per-device. Clearing site data deletes them permanently.
It could, which is why the checks matter more than the promise. On the JWT tool a browser test asserts zero outbound requests during decode, verify and sign, and it runs on every deploy — but you can only take that on trust. The network panel you can see for yourself.