Does ConfigKit upload the JSON I paste?

Converters, validators, and generators parse text in this tab. They do not post editor contents. The URL unshortener is the exception: Expand posts the short links so the server can follow redirects.

How can I check that a paste stayed local?

Open DevTools → Network, paste a distinctive secret, and confirm no request body or query string carries that text. Page load and the Google tag still appear.

Is Kubernetes Secret base64 a safe way to store passwords?

No. Base64 is encoding. Anyone with the manifest can decode it. Use encryption at rest or a secrets manager; this page only makes the bytes readable.

Is it safe to paste secrets into online JSON tools?

A paste into a web page is only as private as that page’s JavaScript, your extensions, and the network tab you can read. “Runs in the browser” is a claim you can test. It is not a reason to treat a random converter as a vault.

What “client-side” actually means

On ConfigKit, converters such as YAML to JSON without uploading, JSON formatter, and ENV to JSON converter parse the editor with JavaScript that already shipped to your browser. There is no application POST of the document. Analytics records that a tool was used, not the text inside it.

That is a narrower promise than “nothing ever leaves this machine.” The HTML, scripts, and the Google tag still load from the network on first visit. A compromised site, a malicious extension, or a browser sync feature can still read a field you typed. Client-side parsing removes the most common leak—an upload to whoever runs the converter—and leaves the rest of the browser threat model in place.

How to verify a tool before you paste

Open DevTools → Network. Disable the cache. Reload the page and note the requests: HTML, JavaScript, fonts, the analytics script. Then paste a unique string, such as ck-secret-probe-17, into the editor and wait for the output to update. Filter the network log for that string. On ConfigKit converters, it should not appear in a URL, query, or request body.

If the tool needs a large parser, the first run may load an extra JavaScript chunk. That is still code, not your document. If you see a request to another origin that includes your paste, stop. A JSON-to-types page that “helps” by sending the sample to an API is a different product.

After the page has loaded, you can go offline and keep converting on this site. That is a useful check for YAML to JSON and the other parsers. It does not apply to the URL unshortener.

The exception on this site

The URL unshortener cannot expand a short link without following HTTP redirects. Pressing Expand posts the listed short URLs to this site. They are not stored as a history of your pastes, and they are not configuration files, but they do leave the browser. Tracking parameters are stripped from the destination after the follow. Do not put a secret in a short link and then ask a remote expander to open it if you would not want that host to see the URL.

Base64 is not encryption

Kubernetes Secret objects store values as base64 under data. That encoding exists so binary can sit in YAML, not so the value is hidden. Anyone with kubectl get secret -o yaml can decode it. The Kubernetes Secret base64 decode online page does that decode in the browser. Useful for reading a manifest you already have. Useless as a protection boundary.

apiVersion: v1
kind: Secret
metadata:
  name: app-credentials
type: Opaque
data:
  username: YWRtaW4=

YWRtaW4= is admin. Put real secrets in a manager, in sealed secrets, or in cluster encryption at rest. Do not paste production tokens into any website you have not inspected, including this one, if your threat model forbids it. The Compare two env files tool masks values by default so a screenshot is less likely to leak them. Masking is a display choice. The unmasked bytes are still in the tab.

What a careful paste looks like

Prefer samples and redacted documents. Replace tokens with REDACTED before they hit the clipboard if you are debugging a public page. Use a local editor when the file is a production secret. If you do paste into ConfigKit, treat the tab as a working copy: close it when you are done, and do not leave a decoded Secret on a shared screen.

Browser extensions with “read all data on websites” permission can see the editor. Password managers that fill forms do not usually fill a CodeMirror document, but screenshot tools and session replay scripts do. If your company injects those, “client-side” is no longer the whole story.

FAQ

Does ConfigKit upload the JSON I paste?: Converters, validators, and generators parse text in this tab. They do not post editor contents. The URL unshortener is the exception: Expand posts the short links so the server can follow redirects.
How can I check that a paste stayed local?: Open DevTools → Network, paste a distinctive secret, and confirm no request body or query string carries that text. Page load and the Google tag still appear.
Is Kubernetes Secret base64 a safe way to store passwords?: No. Base64 is encoding. Anyone with the manifest can decode it. Use encryption at rest or a secrets manager; this page only makes the bytes readable.