Sealed

Provably-local developer tools

Dev tools you can paste your secrets into.

Every tool runs entirely in your browser. Your signing secrets, private keys, and session tokens never leave the tab. There is no backend to send them to.

Network  0 requests  ·  0 B transferred  ·  open DevTools and watch
Try hooksig, live → Why local

One promise, one tool at a time.

Each tool does a single job you'd otherwise paste sensitive data into a stranger's server to do. Open source, MIT, and provably local.

Live

hooksig

Verify webhook signatures from 10 providers, and see exactly what each one signs.

keeps local: signing secrets hooksig.pages.dev →
Live

Cert workbench

Inspect an X.509 certificate: subject, issuer, validity, key type, SANs, CA and self-signed, decoded in your browser.

keeps local: private keys certworkbench.pages.dev →
Planned

HAR sanitizer

Strip cookies, tokens, and PII out of a HAR file before you share it with support.

keeps local: session tokens soon

The moment a tool sends your secret to a server, you have to trust that server. Sealed tools have no server to send it to.

Debugging a signature, a private key, or a network capture means pasting the sensitive thing itself. Most online tools quietly ship it to a backend, where it can be logged, retained, or swept up in a supply-chain breach. In 2025, two of the most popular online formatters were found to have exposed years of everything developers had pasted into them.

Sealed tools are static pages. The work happens in WebCrypto and a Rust core compiled to WebAssembly, right next to your data. Nothing is uploaded. This is not a privacy policy asking for trust: it is the architecture, and you can check it. Open the network tab and use the tool. It stays empty.

Every tool is open source and MIT. Read the code, then watch the wire.

# the whole guarantee, in one command
$ curl https://sealed.tools # static HTML + wasm, no API
# requests made with your secret: 0