Check it yourself.

1. Pull the plug

Open a tool. Switch off Wi-Fi or unplug the network cable. Keep using it. It works because there is nothing to call. The page notices and says so.

2. Watch the network

Open your browser's developer tools (F12, or Option-Command-I on a Mac), choose the Network tab, then use the tool. After the page has loaded, nothing else is requested. Drop in a file and watch the list stay empty.

3. Read the policy

Every tool page carries a Content Security Policy in its own source. Your browser enforces it, not our server. Open any tool, view the page source (Option-Command-U on a Mac, Ctrl-U elsewhere) and find the Content-Security-Policy line in a meta tag near the top. This is what it says:

default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' blob: data:; font-src 'self'; connect-src blob: data:; worker-src 'self' blob:; media-src blob:; object-src 'none'; frame-src 'none'; form-action 'none'; base-uri 'none'; webrtc 'block'

What the important parts mean. connect-src blob: data: means the page's code cannot open a connection to any host. form-action 'none' means no form on the page can submit anywhere. default-src 'none' means the page may load nothing except what the other lines allow, which is only files from its own folder. Each tool also has a "Prove it" button that tries to send data out five different ways and shows you the browser refusing each one.

4. Read the code

Every tool is open source, MIT licensed, with a tagged release for each version. The script and stylesheet tags on each page carry integrity hashes, so the browser refuses to run a file that differs from the published one. In the repository, each tool's folder has a release.txt listing the SHA-256 of every file in that release. Compare it with the tag at github.com/Optimatech-Labs-LLC/toolbox.

What these checks do not cover

We would rather you knew the edges.

A browser extension can read any page you open. That is yours to control.
The policy cannot stop a page from navigating you to another site. You would see that happen, and the public code shows it does not.
Browsers do not yet enforce the "webrtc" rule in the policy. The code is public and contains no WebRTC.
A policy carried in the page cannot stop another site from showing a tool inside a frame on its own page. Use the tools at optimatechlabs.com and check the address bar.
The time on a receipt is your computer's clock, not a trusted time source. The receipt says so.