Security

Security and privacy for a local-first developer toolkit

MyDevTools is built around a simple principle: your work stays local. Everything runs offline on your device, there is no account and no server to hold anything, and sensitive data is encrypted in a local vault. The source is open under the GNU AGPL v3, so none of this has to be taken on trust.

What runs locally

Formatter, parser, converter, and generator workflows are designed to run directly on your device whenever the tool does not need a network service.

  • JSON formatting, Base64 encoding, UUID generation, and similar operations avoid server round-trips.
  • Tools that connect to external services, such as API or database clients, necessarily send requests to the targets you choose.
  • The help docs explain tool-specific data behavior for sensitive workflows.

Local encrypted vault

Sensitive persisted data such as vault-style records is encrypted at rest on your device.

  • Vault contents are AES-256 encrypted on your machine, not stored on a server.
  • Your master password is never transmitted and never leaves your device.
  • Encryption keys derive from your master password, which nothing else receives.

No account, and open source

There is nothing to sign up for and nothing to sign in to, so there is no account data to leak, and the code that makes those claims is public.

  • No sign-up, no sign-in, no activation and no license key — the app has no user accounts at all.
  • The app ships with no backend: there is no server for your data to reach even by mistake.
  • The source is released under the GNU AGPL v3, so you can audit the encryption and network behavior yourself, or build it from source.

Honest limits

Security depends on your device and the external services you choose to connect.

  • Do not paste highly sensitive production secrets into tools you do not control.
  • API and database tools send requests to the destinations you point them at.
  • Review our security model and data handling before team-wide adoption.