Security tools where pasting into a website is the risk

This is the category where online tools are genuinely dangerous. A JWT from your staging environment is a working credential. A production connection string, an API secret, a password you are testing, a TOTP seed: pasting any of them into a server-side tool means handing a stranger something that still works.

Everything here uses the browser's own Web Crypto API and never opens a network connection with your input. You can verify that: open DevTools, switch to the Network tab, and use the tool.