Privacy Policy
Last updated October 2, 2026
This policy explains what data Webmaster Tools (the "Service") handles and why. The Service is operated by Webmaster Tools. It has no accounts, no advertising, no analytics trackers and sets no cookies.
Summary
| What | Where it's processed | How long it's kept |
|---|---|---|
| Formatter, converter, decoder and generator input (JSON, JWTs, passwords, hashes, text…) | Your browser only | Not sent to us |
| Hostnames, domains and URLs you check with network tools | Our server, which contacts those hosts | Not stored beyond server request logs |
| Requests captured by the webhook inspector | Our server, in memory | Last 100 per URL; deleted after 24 hours without activity, when memory runs short, or when the server restarts |
| Requests you send with the HTTP request builder | Our server, which sends them on | Not stored beyond server request logs |
| AI assistant messages and the results of checks it runs | Our server and Anthropic | See "AI assistant" below |
| Server request logs (IP address, time, method, path and query string with tokens, pasted input and webhook IDs removed, status) | Our server | 30 days |
| Tool suggestions you send, and your email if you give one | Our server | Up to 12 months |
| Your preferences and assistant conversation | Your browser's storage | Until you clear it |
Data processed in your browser
Most tools run entirely in JavaScript on the page. Their input never leaves your device. That includes the email header analyzer, the webhook signature verifier and the JWT generator: headers, secrets and private keys you enter there are processed in your browser and never sent to us. The WebSocket tester connects your browser directly to the WebSocket server you enter, not through us.
Data processed on our server
Network tools. When you run a DNS, WHOIS, SSL, redirect, header, CORS, robots.txt, meta tag, email, port, indexability, sitemap, structured data, CSP, cookie, security.txt, HTTP/2, MTA-STS or BIMI check, the host or URL you enter is sent to our server, which queries DNS resolvers, WHOIS servers or the target host directly. Those third parties see the request as coming from our server. The CSP evaluator and the structured data validator also accept a pasted policy or page source, which is sent to our server to be parsed and is not stored.
Webhook inspector. Each request sent to a webhook URL is captured in full, including headers, body, query string and the sender's IP address, and streamed to anyone viewing that URL. Captured requests are kept in memory only: the latest 100 per URL, bodies up to 256 KB. A URL that receives nothing and isn't being viewed for 24 hours is deleted, the least recently used URLs are cleared first if the inspector reaches its memory limit, and everything is erased when the server restarts. If you enable forwarding or use replay, the captured request is sent to the target you choose; both work only while the inspector page for that URL is open.
HTTP request builder. The method, URL, headers and body you enter are sent to our server, which makes the request and returns the response to you. Neither is stored.
Tool suggestions. When you send the Suggest a tool form, we store what you wrote, the email address if you entered one, the time, and the page you came from. We don't store your IP address with it. We use suggestions only to decide what to build, and the email only to reply about your suggestion. Suggestions are deleted after 12 months, or sooner if you ask.
Server logs. Like most web servers, ours logs each request: IP address, time, method, path, query string, response status, size, duration, browser user agent and referrer. Query strings can include values from tool links, such as a domain or URL being checked; tokens (?token=), pasted input (?input=) and webhook IDs are removed before a line is written, from both the address and the referrer. We use logs to operate, secure and debug the Service and to identify abuse, not for analytics, and they are rotated and deleted after 30 days.
AI assistant
When you use "Ask AI", your messages, the conversation so far, the page you're on (its path and the domain, host or URL it is checking; webhook IDs, tokens and pasted input in the address stay in your browser), and the results of any checks the assistant runs are sent from our server to Anthropic, PBC, which provides the Claude model that writes the replies. Anthropic processes this data under its commercial terms and privacy policy, which govern how long it retains API data. We don't use your conversations for any other purpose. The conversation itself is kept in your browser's session storage and disappears when you close the tab or start a new conversation.
Please don't include passwords, API keys, personal data or other secrets in assistant messages. When Anonymize is on, emails, IP addresses, UUIDs, JWTs and card numbers in your messages and in the page address are masked in your browser before anything is sent.
Browser storage
We use your browser's local and session storage, not cookies, to remember things like the anonymize toggle, your light or dark theme, whether the tools menu is hidden, your recently used tools, your webhook URL, Markdown drafts, the time zones you added in the Time Zone Converter (wmt_tz_list) and the assistant conversation. When one page hands data to another, it is kept in this tab's session storage only until the next page reads and deletes it: a captured request when you choose Verify signature in the webhook inspector (wmt_sig_handoff; your signing secret is never stored), and email headers you paste into the search or home box (wmt_headers_handoff). This data stays on your device and is never sent to us automatically. You can clear it at any time from your browser settings.
Third-party resources
None. Fonts and JavaScript libraries (HTMX, Alpine.js, marked, DOMPurify and the others the tools use) are served from our own server, so opening a page doesn't make your browser contact anyone else. The only outside requests are the ones a tool makes for you, such as the WebSocket tester connecting to the address you enter.
Sharing
We don't sell or rent data. Data is shared only as described above (the hosts you check, Anthropic for the assistant, and the targets you forward or replay webhooks to), with service providers that host the Service, or when required by law.
Security
Traffic should be served over HTTPS in production. Webhook URLs are unguessable random IDs but are not password protected; anyone with the URL can view what it captured. The anonymize toggle masks emails, IPs, tokens and card numbers on screen for screen sharing. It does not change what tools send to the server; assistant messages are the exception, as described above.
Your choices and rights
You can use the in-browser tools without sending us anything, avoid the assistant, and clear your browser storage at any time. Depending on where you live, you may have rights to access, correct or delete personal data about you. Because we don't keep accounts, the main personal data we hold is server logs and short-lived webhook captures. To make a request, contact hello@webmastertools.dev.
Children
The Service is a technical tool for developers and isn't directed at children.
Changes
We may update this policy. The date at the top shows when it last changed.
Contact
Privacy questions and requests: hello@webmastertools.dev.