The pattern
A familiar shape: you have a JSON blob, a JWT, a SQL query, a regex. You want it formatted, decoded, or checked. The first result on search is a clean, fast website. You paste. It works. You move on.
Many of these tools claim to be “client-side only.” That claim is often true for the visible feature — and irrelevant for what actually happens around it. Analytics scripts, error reporters, session replay, ad SDKs, and “improve our service” telemetry are usually loaded on the same page. Each of them can see what you typed before the formatter ever touched it.
What actually leaks
A short, non-exhaustive list of common online tools and what tends to escape with the page load:
| Tool | What can leak |
|---|---|
| JSON / XML / YAML formatters | Whole payloads — internal API responses, customer records, anything you pasted in to indent. |
| JWT debuggers | Live access tokens, claims, signing secrets. Often pasted unchanged from production. |
| SQL beautifiers | Queries (and the table / column names that reveal your schema), sometimes with sample rows inline. |
| Regex testers | The pattern (which tells the reader what you guard against) plus the test strings (often real examples). |
| Base64 / URL encoders / decoders | Whatever you encoded — credentials, session ids, signed URLs, anything assumed to be opaque. |
| Diff checkers | Both files, byte-for-byte. Often config files, secrets files, or contract drafts. |
| JS minifier / beautifier | Source code — including comments, internal endpoints, and any embedded keys. |
| cURL → code converters | The full request including Authorization headers, cookies, and request bodies. |
None of these are inherently malicious sites. The leak is structural: third-party scripts on a page see everything that page sees, including the text you just pasted into a form field.
Why people keep using them
Because they're fast, free, and the alternative is opening an IDE, finding the right extension, or writing ten lines of code. For one-off work, the calculus almost always tilts toward the online tool. The risk is real but small per session, so it stays in the “I'll be careful” bucket and out of the “I'll change my workflow” bucket.
How Kyane changes the calculus
Kyane is a small macOS utility that blocks the noisy scripts (analytics, telemetry, error reporters, ad SDKs) on the pages you visit, while leaving the actual formatter / debugger / converter logic alone. You still paste. The page still formats. The exfil pipeline doesn't fire.
- Quiet by default. A curated list of common noisy scripts is blocked without configuration.
- Precise. The formatter still works because Kyane doesn't block the page's own logic — only the third-party noise around it.
- Local. No account, no cloud rule sync in v1. Your decisions stay on your Mac.
- Reversible. Per-site toggle. If a tool genuinely needs one of the scripts to run, allow it on that site and move on.
What you can do today
Three habits that already reduce the surface, with or without Kyane:
- Prefer offline tools. Most IDEs format JSON, decode base64, and pretty-print SQL natively. Command-line tools like
jq,sqlformat, andbase64are one line and zero network calls. - Check the network tab. Before pasting anything sensitive, open DevTools → Network and watch what fires when you paste a single character. If anything goes outbound, treat the rest of the page accordingly.
- Strip secrets first. Replace tokens, ids, and PII with placeholders before pasting. The formatter doesn't need the real value to do its job.
The quiet alternative
Quiet browsing. Noisy scripts off.
Kyane is a small macOS utility built to make the cost of the convenient web a lot lower. No account, no cloud, no drama.