Privacy
What Toolbench stores, for how long, and who can see it.
Never leave your browser. Signature verification and signing test events run locally with the Web Crypto API. Secrets aren't sent to our server, logged or stored, and they're gone when you close the tab.
When something sends a request to your inbox URL, we store it so the inbox can show it: the method, path and query, headers, body (up to 128 KB), the sender's IP address and the time it arrived.
- Each inbox keeps its last 50 requests, and every captured request is deleted automatically 7 days after it arrives.
- Anyone who has an inbox URL can read that inbox. There are no accounts, so the URL is the key. Don't share it.
- You can delete single requests or clear the whole inbox at any time, and New URL starts a fresh one.
- Don't send production data you're not allowed to share with a third party; use test mode where you can.
Test events are signed in your browser, then relayed through our server to the URL you enter, because browsers can't send cross-origin webhooks directly. The relay passes on the signed request and returns the response; it doesn't store either.
Specs you paste, type or upload are validated in your browser and never sent to our server. If you use Load from URL, our server downloads that URL for you (browsers block most cross-site downloads) and passes the file straight back; it isn't logged or stored.
To stop the relay, the inbox and the spec downloader being misused, we count requests per IP address over short windows (a few minutes) and per day. These counters hold no request content and expire on their own. The relay and the spec downloader refuse private and local network addresses and non-standard ports.
No accounts, no cookies, no analytics. Your inbox ID is kept in your browser's local storage so the same URL is there when you come back.
Email ankursainiwork@gmail.com.