In short
- What you paste into a tool (a 2FA secret key, JSON) is processed in your browser. It is not sent to our server and not saved.
- You do not need an account.
- There are no ads and no cookies, and nothing follows you from site to site. To count visits we use Cloudflare Web Analytics (see “Visit statistics” below).
What happens in your browser
2FA codes: the key you enter is only used to work out the code on your device. A link made with “Copy link” puts the key after the # sign, and browsers never send the part after # to a server.
JSON formatter: formatting, checking and repairing all happen in your browser. There is no “save online” and no share link.
Exception: if you type a key into the address bar yourself (for example nebarc.com/tools/2fa/YOURKEY), or use the 2FA developer API, the key does reach our server. It is only used to work out the code for the reply. Our code does not store or log it. The API also accepts the key in a POST body, which keeps it out of the address.
What is saved on your device
Only preferences, in your browser’s local storage (these are not cookies): light or dark theme, language, and the JSON formatter’s indent, key sorting and view.
They stay on your device and are never sent to us. Clearing your browser data removes them.
Servers and the 2FA API
Nebarc runs on Cloudflare. When you open a page or call the API, Cloudflare handles the connection and deals with connection details such as your IP address under its own policy, which we do not control. See Cloudflare’s privacy policy for details.
To stop abuse, the 2FA API limits how often one IP address can call it. Our code hands the address to Cloudflare’s rate limiting feature only to count calls; we do not keep it ourselves, and we have turned request logging off.
When the 2FA page shows a code, it asks our server for the time to correct your device clock, at most about once an hour. That request has no key in it.
Visit statistics
To see which pages people use and how fast they load, the pages you view load a small script from Cloudflare Web Analytics (static.cloudflareinsights.com) once the page has finished loading. Pages that only send you on to another address (for example the one that picks your language) do not load it. It reports to Cloudflare (cloudflareinsights.com) the page address, the referring site, the browser and device type, the country (worked out from your IP address) and loading times. We only see totals.
Visitors from every country are counted the same way, including the EU and the UK.
It sets no cookies, saves nothing on your device and does not follow you to other sites. The address it reports leaves out everything after # and ?, so the key in a 2FA link is not part of it.
Blocking the script, for example with an ad blocker, does not affect any tool.
Changes
If a tool starts to collect or send something new, this page is updated first, and the date above changes.
Questions
Write to hello@nebarc.com.
Last updated ·