Frequently Asked Questions
How Z Tools processes data, what is retained, and what the tools are designed to do.
Do all tools run only in my browser?
No. JSON, JWT, Base64, Hash, URL, Markdown, QR, Password, Case, and Color perform their primary tool processing locally in your browser. Image Compressor uses temporary server processing because it runs through PHP GD.
What happens to an uploaded image?
The Image Compressor validates a bounded upload, stores it under a randomized session-bound name, processes it with PHP GD, and exposes the result through a short-lived protected download URL. Temporary image files are cleaned within 5 minutes.
Does Z Tools keep analytics?
Yes. The site uses its own access-statistics system. It records an anonymized IP prefix, request path, event type/target, referrer host, country code when supplied by the edge, a truncated user-agent string, and HTTP status. Analytics files are retained for 180 days. See the Privacy Policy for the exact model.
Can analytics include a tool value in a URL?
Potentially. Some browser tools can synchronize state into a query string for sharing/reloading. The access logger records the request path (including the query string) when a page is requested. Do not place secrets in a shareable tool URL or reload a URL that contains confidential input.
What happens to Contact Form messages?
Name, email address, category, and message text are stored in a protected server directory so they can be reviewed in the existing admin dashboard. Messages are kept until manually deleted; the site does not email the submission to an external mailbox.
Why does the JWT tool say decoding is not verification?
A JWT payload is Base64URL-encoded data and can be decoded by anyone. Trust requires a valid signature checked with the expected key and algorithm, plus application-specific validation of claims such as issuer, audience, expiry, and not-before time.
Why are MD5 and SHA-1 still available?
Legacy systems and checksum workflows still expose them. Z Tools labels them as legacy/non-security choices. For security-sensitive integrity work, use a modern SHA-2 algorithm or the algorithm required by your protocol.
Which browsers are supported?
Current versions of Chromium-based browsers, Firefox, and Safari are the target. Features that depend on Web Crypto, Canvas, FileReader, Clipboard, or modern Unicode regular expressions need a reasonably current browser. The server-side Image Compressor does not depend on browser image codecs after upload.
How are benchmark claims produced?
Bounded offline scripts produce JSON/CSV result files with a timestamp, environment, methodology, and raw cases. Scripts are not exposed as public benchmark endpoints. If a required codec/runtime is missing, the result records a skip rather than inventing a number.
How do I report a bug or request a feature?
Use the Contact Form and choose the closest category. Include a minimal reproducible example when possible, but do not submit passwords, access tokens, private keys, or other secrets.