Privacy

privileged.id sets no cookies and loads no third-party scripts, fonts, images or trackers. Links to standards bodies and other sources take you to those sites, which have their own policies.

What you paste into the tools

The JWT decoder, SAML decoder, OAuth flow visualiser, password policy checker and checklist builder run entirely in your browser. Tokens, keys, secrets and SAML messages you paste are processed in the page and are never sent to this server or anyone else, and never stored. This is enforced as well as promised: the site's Content Security Policy only allows its own scripts to run and only allows them to fetch files from this site, and the only file they fetch is the search index. You can confirm it in your browser's developer tools (Network tab) while using a tool.

Even so, treat production secrets carefully everywhere: a private key or live token pasted into any web page could be exposed by a compromised browser extension on your own machine.

Stored in your browser

Two conveniences are saved in this browser's local storage, and only when you use them: your light or dark theme choice, and the boxes you tick and environments you choose in the least-privilege checklist. They never leave your device, are not cookies, and you can clear them in your browser settings at any time. Nothing you paste into the decoders is stored.

If this ever changes, for example if advertising is added, this page will say so before it happens.

Server logs

Like almost every website, the server keeps a log of requests: the time, the page requested, the referring page, the browser's user-agent string, and a shortened network address (the last part of the IP address is removed before anything is written, so the log cannot point to one connection). The log is used only to count visits and to stop abuse, is never shared or sold, and is deleted after 30 days. The legal basis under the GDPR is legitimate interest in running and securing the site.

The hosting proxy in front of this site (measured 2026-10-26): successful requests are not logged there. Requests that fail at the proxy are recorded with the visitor's IP address and browser user-agent, with cookies and authorization headers redacted, and are currently kept until the proxy is restarted. A retention limit for those records is under review.