Security First

    Built with security at the core.

    Last updated: February 2026

    Tool Inputs Stay in Your Browser

    All tool logic on Tooltri runs entirely within your browser using client-side JavaScript. Your financial figures, passwords, JWT tokens, Base64 strings, code snippets, images and files are never transmitted to our servers. This is not a policy promise; it is an architectural fact. The only network traffic our platform generates is Google Analytics page-view events and, when you submit the Contact or Support form, the message you choose to send us.

    What We Do and Do Not Store

    Tooltri stores nothing server-side from tool usage. When you use a tool, nothing you enter leaves your browser. Financial calculator inputs, theme preference and currency choice are saved in your own browser's local storage so a refresh does not reset them; we cannot see those values. Contact and support messages are queued briefly in our server until the email is sent, then removed from the queue. We do not keep them in a database.

    HTTPS & Encrypted Connections

    All pages and resources on Tooltri are served exclusively over HTTPS with modern TLS encryption. This ensures that your connection to our platform is encrypted and protected against man-in-the-middle interception. Any data transmitted between your browser and our servers - which is limited to loading the tool interfaces themselves, not your input data - is encrypted in transit. We do not serve any content over unencrypted HTTP.

    Password Generator Security

    The Password Generator on Tooltri uses the browser's native Web Crypto API (crypto.getRandomValues) to generate cryptographically secure random values locally in your browser. It uses rejection sampling to eliminate modulo bias and an unbiased Fisher-Yates shuffle to mix character positions. Generated passwords are never transmitted over the network, never logged and never visible to Tooltri or any third party. The generated password exists only in your browser until you copy it. We recommend immediately storing generated passwords in a reputable password manager (Bitwarden, 1Password or KeePassXC) rather than writing them down or storing them in plain text.

    Financial Data Security

    All financial figures you enter into our calculators (including investment amounts, loan values, interest rates, profit margins and advertising budgets) are processed exclusively within your browser and are never transmitted to our servers. Our financial calculators (SIP, SWP, EMI, ROI, CPM, Profit Margin) perform all calculations using local JavaScript execution. To save you retyping after a refresh, the values you enter are kept in your browser's local storage; they stay on your device and we cannot see them.

    Developer Tool Security

    Sensitive data processed through our developer tools - including JWT tokens (which may contain authentication claims and signing secrets), Base64-encoded images or files, URL-encoded strings, JSON payloads (which may contain API keys or credentials) and Unix timestamps - is handled exclusively within your browser session. None of this data is transmitted to Tooltri's servers or any third-party service. We strongly recommend not processing production secrets or live credentials in any online tool as a general security practice.

    Third-Party Services

    Tooltri loads Google Analytics on all pages. Analytics collects aggregate data such as page views, tool clicks and country-level geography; it never receives your tool inputs. Google AdSense is planned but not yet active; no ad scripts load today. To minimize third-party script exposure, you can use a browser content blocker. All core tool functionality continues to work with ad blockers enabled.

    Responsible Disclosure

    If you discover a security vulnerability in Tooltri - including issues with our client-side tool implementations, content security policy, HTTPS configuration or third-party integrations - we encourage responsible disclosure by contacting us directly through our contact page. We take all security reports seriously and will acknowledge and address legitimate vulnerabilities promptly. We appreciate the security community's role in keeping online tools safe for all users.