Privacy and Cookie Policy

The short version

This site sets no cookies, runs no analytics and contains no trackers or advertising. Certificates, signing requests and private keys you paste or generate are processed in your browser and are never sent to us. Five tools do send data to our server, and three of those forward what you enter to a third party. The rest of this page explains exactly what, and why.

Who is responsible for your data

The data controller for this site is Pattaradol Nonting, an individual established in Thailand. For any privacy question or request, including a request for our postal contact details, contact [email protected].

Cookies and similar technologies

We set no cookies of our own, and we use no analytics, advertising, web beacons, pixels or fingerprinting. The site stores nothing in local storage, session storage or IndexedDB, and embeds no third-party fonts or images.

One exception: the five pages that talk to our server — SSL Checker, CAA Lookup, CT Log Search, Chain Builder and the Let's Encrypt Staging Test — load Cloudflare Turnstile from challenges.cloudflare.com to keep the tools from being used as an automated scanning service. Turnstile may store a short-lived token in your browser to run and validate that challenge. It is used only for abuse prevention, never for analytics, advertising or profiling, and Cloudflare states it does not use it to track individuals across sites. The other tools load no third-party script at all.

We treat this as strictly necessary to provide a service you asked for, which is why there is no cookie banner. Nothing optional is loaded, so there is nothing to opt out of. If that ever changes, this page will be updated first and consent will be sought where the law requires it.

What stays in your browser

The Certificate Decoder, CSR Decoder, Certificate / Key Matcher, Format Converter, PEM to PFX Builder, CAA Record Helper, Self-Signed Certificate Generator, SPKI Pin Generator and Key Pair & CSR Generator run entirely on your device using the browser's own Web Crypto API. That includes PKCS#12 in both directions: a .pfx file and the password that opens it are read in the browser tab, and a new .pfx is assembled there from the certificate and private key you paste, so neither the file, the password nor the private key inside it is ever transmitted. Certificates, signing requests, private keys and passwords you paste into those tools are never transmitted to our server and never leave your machine. We cannot see them, and they are not stored anywhere by us.

Generated private keys exist only in the memory of the browser tab. Closing or reloading the page destroys them.

What is sent to our server

Seven tools need a server, because a browser cannot open a raw TLS socket, make a DNS query, fetch from a CA or speak the ACME protocol:

• Domain SSL Checker — the hostname and port you enter are sent to our server, which opens one TLS connection to that host and reads back the certificate chain it presents. The target host will see a connection from our server's IP address, not yours.
• Bulk SSL Expiry Check — the list of hostnames you paste is sent to our server, which opens one TLS connection to each and reads back the certificate it presents. Each target host sees a connection from our server's IP address, not yours. The list is used to answer that one request and is not stored.
• TLS Version Check — the hostname you enter is sent to our server, which opens one connection per protocol version to it and one request for its Strict-Transport-Security header. Five connections in total, all to the host you named and to nobody else.
• CAA Record Lookup — the domain you enter is sent to our server, which performs DNS queries for that name and its parent domains through its configured resolver.
• CT Log Search — the domain you enter is sent to our server, which forwards it to Cert Spotter, operated by SSLMate, Inc., to search the public Certificate Transparency logs. That third party receives the domain name and our server's IP address, and handles it under its own privacy policy. If you would rather not involve a third party, do not use this tool.
• Chain Builder — the certificate you paste is sent to our server, which may then download intermediate certificates from the CA URLs named inside it. Certificates are public documents and no private key is involved. Nothing is stored.
• Let's Encrypt Staging Test — the certificate signing request you paste is sent to our server, which forwards it to the Let's Encrypt staging ACME endpoint to open an order. A CSR contains the hostnames you want certified and a public key; it never contains a private key. The order is held in our server's memory for at most one hour so you can complete the challenge, then discarded. The "Check CSR only" button on that page contacts nobody: it parses the request on our server and answers immediately.

We do not retain the certificates, chains or DNS answers returned by these lookups beyond the response sent back to your browser.

Server logs

Like any web server, ours processes technical data needed to serve and protect the site: your IP address, the request time, path and query, the HTTP status, and your browser's user-agent string. This is used only to operate the Service, to apply rate limits and to investigate abuse or faults.

The Service runs on a small server we operate ourselves, reached through a Cloudflare Tunnel. The application itself writes no per-request log. The operating system and the tunnel client on that machine keep short operational logs, which are deleted after 14 days. Cloudflare, as the proxy in front of us, separately processes and briefly retains request data under its own retention periods; we do not enable any additional logging, log export or long-term storage on top of it.

Note that when you use one of the seven server-side tools, the domain you queried appears in that request data. Do not submit hostnames you consider confidential.

Under the GDPR, the lawful basis for this processing is our legitimate interest in operating a secure, functioning service (Art. 6(1)(f)).

Who else receives data

• Cert Spotter (SSLMate, Inc.) — receives the domain name when you use CT Log Search, as described above.
• Google LLC (Gmail) — hosts the mailbox that our contact addresses forward to, and therefore processes anything you choose to put in an email to us.
• Internet Security Research Group (Let's Encrypt) — receives the certificate signing request you submit to the Let's Encrypt Staging Test, which contains the hostnames you are asking to certify and a public key. It never receives a private key.
• Resend (Plus Five Five, Inc.) — delivers the replies we send from our contact addresses, and therefore processes the content of those replies.
• Cloudflare, Inc. — sits in front of the Service as our reverse proxy and tunnel provider, and therefore processes all traffic to it on our behalf. Cloudflare Email Routing also forwards mail you send to our contact addresses to our own mailbox.

We do not sell, rent or share personal data with anyone else, and we do not use it for advertising or profiling.

International transfers

Our server is located in Thailand. Requests reach it through Cloudflare's global network, so your request is first handled at a Cloudflare data centre near you — possibly outside your own country — before being forwarded to us over the tunnel. Cloudflare, Inc. is established in the United States and acts as our processor under its data processing agreement and the EU Standard Contractual Clauses. Using CT Log Search or the Let's Encrypt Staging Test may involve a further transfer to the United States, where SSLMate, Inc. and the Internet Security Research Group operate, and email correspondence involves the United States, where Google LLC (our Gmail mailbox) and Resend (our outbound mail provider) operate.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. Because we hold nothing but short-lived server logs keyed to an IP address, exercising some of these rights may require you to identify the relevant requests.

To make a request, contact [email protected]. You also have the right to complain to your local data protection authority.

Children

The Service is a technical tool aimed at IT professionals. It is not directed at children and we do not knowingly collect data from them.

Changes to this policy

If this policy changes, the “last updated” date above will change with it. Material changes will be summarised at the top of this page.