What this site sends anywhere
Short version: almost nothing. The tools here exist because the alternative was pasting webhook secrets and card numbers into someone else's server, so the design goal was to make that unnecessary.
Last updated
Tools that run entirely in your browser
These tools do all their work on your device. What you paste into them is never transmitted, never logged and never stored — not to this site, and not to anyone else:
- Webhook signature verifier
- UPI link & QR generator
- Bharat QR / EMVCo decoder
- ISO 8583 parser & builder
- Card test toolkit
Cryptography goes through the browser's built-in Web Crypto API. Parsing and validation are plain JavaScript running in the page. There is no upload step and no background request carrying your input.
You do not have to take this on trust. Open your browser's network tab and use any of these tools — nothing you type produces a request. Or disconnect from the network entirely: they keep working, because there was never anything on the other end.
If you are watching that network tab, you will see one request when the page loads, to /_vercel/insights. That is the page-view counter described below. It fires once for the page and carries no part of what you typed. It is named here rather than left for you to find, because a page that tells you to check and then shows you something unexplained has earned the suspicion.
The one exception: IFSC lookup
IFSC lookup is the single tool here that sends anything to a server, and it is marked as such on its own page. Looking up a branch needs a directory of every bank branch in India, which is far too large to ship to a browser, and the upstream directory sends no CORS headers, so the request cannot be made from the page. The code you type goes to this site's own endpoint, which forwards it to ifsc.razorpay.com and caches the answer for a day.
An IFSC is public information printed on cheque books, so nothing sensitive is involved. The structure check on that page still runs locally; only the branch lookup leaves your device. The exception is stated rather than glossed over, and if any other tool ever needs a server it will get the same treatment: a visible notice, never a quiet downgrade.
What is measured, and what cannot be
The site counts page views and page-speed measurements, using Vercel Web Analytics and Speed Insights. Between them they record the page address, the site that linked you here, a coarse device type and country, and how quickly the page rendered. They set no cookies, do not fingerprint your browser, and cannot follow you to other sites. They are served from this domain, not fetched from a third party.
What they cannot see is anything you put into a tool. No tool on this site writes what you typed into the page address — not into a query string, not into the part after the #. So there is nothing in a URL for a page-view counter to carry, and a payload, a secret or a card number can never become part of what is measured. That is a deliberate constraint on how these tools are built, not a happy accident.
There is no tag manager, no session recorder, no error-reporting service, and no advertising or cross-site tracking of any kind. Fonts are served from this site rather than fetched from a font CDN, so loading a page does not tell anyone else that you visited.
Accounts are optional and separate
The tools need no account and never will. There is an account area for paid features — a persistent webhook capture endpoint, and API access — and it exists only if you choose to sign up. Signing in sets a session cookie so that you stay signed in. That is the only cookie this site sets, and it is set only after you have created an account.
Those paid features are a different arrangement, and it would be dishonest to blur them into the promise above: there, you are deliberately sending your own webhook traffic to your own account so that it can be stored and inspected. That is opt-in, it is described on its own pages, and it takes nothing away from the free tools, which continue to send nothing anywhere.
What the host necessarily sees
This is true of every website and it would be misleading to omit it: requesting a page means the server hosting it receives your IP address, the address you asked for, and your browser's user agent, and these ordinarily appear in access logs kept by the hosting provider. That applies to page loads and to the IFSC endpoint.
What it does not include is the content you put into any browser-side tool, because that content never becomes part of a request in the first place.
Card numbers and payment data
The card tools accept test data and are built so that a real card number would not leave your machine even if you pasted one. Please still use test data. A real PAN in your clipboard, your browser history or a screenshot creates exposure that has nothing to do with this site and that no tool here can undo for you. The ISO 8583 parser masks cardholder data by default for the same reason.
If this ever changes
The “runs in your browser” badge on each tool page and the list above are generated from the same single flag in the source, so they cannot drift apart. Any change would appear on the tool page, here, and in the site's public git history at the same time.
Contact
Questions about any of this, or a correction to something stated here, can go to the team behind moveahead.tech.