Ameen Usman

Thank you. Keeping the file on the device was the whole point. Glad that part came through.

I’m building KeptTools, a set of free developer tools that run in the browser. The part I’m on now is the PDF tools. You can merge files and set the order, split by ranges like 1-3, 5, compress a PDF while the text stays selectable, turn pages into JPG, or build a PDF from images. The file stays on the device. Nothing is uploaded. kepttools

Fair points — thanks for the precise pushback. You’re right on the privacy wording: “nothing leaves your browser” means we don’t upload the paste to our servers. It doesn’t protect against a malicious extension or someone with access to the machine/DOM. I’ll tighten that language so the claim stays honest. On JWT: decode-only is intentional today, and the page already notes it doesn’t verify the signature — but I agree a decode-only view can still create false confidence if someone skim-reads. Optional local verification with a pasted secret (for staging) is a strong feature request; I’ve noted it. Appreciate the threat-model feedback.

Good call — a hint on 16-digit values would stop that “year 50,000” confusion before it starts. I’ll keep that with the microseconds note: detect the length and show a clear cue (or convert) instead of silently treating it as seconds. Thanks for the practical UX tip.

Thanks — that’s a really useful rule of thumb. KeptTools already treats 10-digit values as seconds and 13-digit as milliseconds, and showing UTC + local side by side was exactly to avoid those “off by a few hours” bug-report mistakes. Microseconds (16 digits) from Python/DB exports is a good call too — I’ve noted that as feedback. Appreciate you adding this.