Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. Summary

• No tracking, no analytics tools, no advertising.
• No embedded third-party content – fonts, icons and graphics are hosted on this server.
• No social media plugins and no user accounts.
• Only technically necessary cookies (see section 4).

3. Hosting & server log files

This website is hosted by the following provider: Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider.

Each time a page is accessed, the web server automatically processes information transmitted by your browser and stores it in so-called server log files:

• IP address of the requesting device
• date and time of access
• requested address (URL) and amount of data transferred
• HTTP status code (e.g. “page found” or “not found”)
• referrer URL (the previously visited page), if transmitted
• browser and operating system used (user agent)

This processing is technically necessary to deliver the website and to ensure its stability and security (e.g. to fend off attacks). The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in the secure and error-free operation of the website. The log files are deleted after 6 weeks, unless they are needed for longer to investigate a specific security incident. They are not combined with other data sources.

4. Cookies

These cookies are strictly necessary for the functions you request; consent is therefore not required under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the associated processing is Art. 6(1)(f) GDPR. You can delete cookies at any time in your browser settings. No other cookies are set.

5. Language selection

This website is available in German and English. When you open a page from outside the website (e.g. via a link or a bookmark), the server checks your browser’s language setting (the HTTP header “Accept-Language”, which your browser sends with every request) and redirects you to the matching language version, provided the page exists in that language. If your browser prefers neither German nor English, you get the English version. This information is only used for this decision and is not stored.

If you change the language with the switcher, your choice is stored in the cookie lang (see section 4) and also applies to later visits. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in showing you the website in your language.

6. Fonts & content

All components of this website – fonts, icons, graphics, stylesheets and scripts – are loaded exclusively from this server. No third-party content (e.g. Google Fonts, content delivery networks, video or map services) is embedded, so your IP address is not transmitted to other providers when you visit a page.

The animations and filter functions run via JavaScript directly in your browser. No data is sent to the server or stored in the browser in the process.

7. Contact by email

If you send me an email, I process your email address, your name (if provided) and the content of your message in order to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or to taking steps prior to entering into a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Your data is deleted as soon as your request has been dealt with conclusively and no statutory retention obligations apply.

8. Search on the tools page

The search and the category filters on the “Webmaster Tools” page run directly in your browser. So that search results can be linked, the search term appears in the address bar (e.g. ?q=sitemap). If such an address is requested, it becomes part of the server log files like any other requested address (see section 3). It is not evaluated in any other way.

9. Webmaster tools

This website offers free online tools. No registration is required.

The tools “Sitemap Generator”, “Open Graph Preview”, “SSL Check”, “Security Header Check”, “HTTP Status Check”, “Redirect Checker”, “DNS Lookup”, “WHOIS Lookup” and “My IP Address” send your input to the server for processing. What exactly happens is described for each tool:

Meta Tag Generatorbrowser only

All input is processed exclusively in your browser; importing existing tags is also evaluated locally. No input is sent to the server, no cookies are set and no data is stored in the browser. Exception on your explicit click: if you load the preview image (“Load image”), your browser fetches the image directly from the server at the address you entered. Like with any image request, that server receives your IP address and browser information; the operator of that server is responsible for this processing. “Share link” stores your input only in the part after the #, which is not sent to the server.

robots.txt Generatorbrowser only

Rules, sitemaps, imported robots.txt content and test addresses are processed exclusively in your browser and are not sent to the server. The file download is also created locally in the browser. No cookies are set and no data is stored in the browser. “Share link” stores your input only in the part after the #, which is not sent to the server.

Sitemap GeneratorServer

“Crawl website” mode: your browser sends the start address you entered and, in turn, a few addresses of the same website to be checked to my server. The server fetches these pages and the website’s robots.txt (as “gutowski.org-SitemapBot”) and returns only the status code, redirect, file type, modification date, noindex/canonical information and the links contained to your browser. The fetched content is neither stored nor analysed. The fetched website sees the IP address of my server, not yours. To prevent abuse (e.g. mass requests to third-party websites), the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page request. “Paste addresses” mode: runs exclusively in your browser. The finished sitemap.xml is created locally in the browser; no cookies are set.

SERP Snippet Previewbrowser only

Title, description, address and search term are evaluated exclusively in your browser and are not sent to the server; the entered address is not opened. No cookies are set and no data is stored in the browser. “Share link” stores your input only in the part after the #, which is not sent to the server.

Open Graph PreviewServer

Your browser sends the address you entered to my server. The server fetches the page (as “gutowski.org-OGPreview”, up to 5 redirects) and reads title, language, meta tags and individual link elements from the HTML head; it then fetches the specified preview image and passes it, together with dimensions, file size and format, directly to your browser. As a result, your browser does not make any requests to third-party servers. Nothing is stored; the websites fetched see the IP address of my server, not yours. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page view. The links to the Facebook Sharing Debugger and LinkedIn Post Inspector lead to the respective providers; their privacy policies apply there. With “Share link”, the address is stored in the # part of the link, which is not sent to the server.

Keyword Density Analysisbrowser only

The pasted text or HTML source code is analyzed exclusively in your browser and is not sent to the server. HTML is only read as an inactive document – scripts do not run, images are not loaded. No cookies are set and no data is stored in the browser. “Share link” stores the text only in the part after the #.

Schema.org Generatorbrowser only

All information is processed into JSON-LD exclusively in your browser and is not sent to the server; entered addresses are not visited. No cookies are set and no data is stored in the browser. “Share link” stores the data only in the part after the #. The links to Google’s Rich Results Test and the Schema validator open third-party websites – data is only transferred there if you paste the code yourself.

Hreflang Generatorbrowser only

Language codes, addresses and imported source code are evaluated exclusively in your browser and are not sent to the server; the addresses are not visited. No cookies are set and no data is stored in the browser. “Share link” stores the data only in the part after the #, which is not sent to the server.

SSL CheckServer

Your browser sends the domain you entered to my server. The server establishes an encrypted connection to this domain (port 443), reads the certificate and the supported TLS versions, fetches the home page via http:// and https:// (only status code and headers are evaluated, not the content) and queries the domain’s CAA records in the DNS. The result is returned to your browser and evaluated there; it is not stored. The checked website sees the IP address of my server, not yours. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page request. The calendar reminder and the certificate download are created locally in your browser. With “Share link”, the domain is placed in the # part of the address, which is not sent to the server; the check is only started when the link is opened.

Security Header CheckServer

Your browser sends the address you entered to my server. The server fetches this address once (as “gutowski.org-HeaderCheck”) and follows up to 5 redirects. Only the status codes and HTTP headers of the responses as well as a Content-Security-Policy set in the HTML head are returned to your browser; the rest of the page content is discarded after retrieval. The rating takes place in your browser; nothing is stored. The website checked sees the IP address of my server, not yours. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page view. With “Share link”, the address is stored in the # part of the link, which is not sent to the server; the check only starts when the link is opened.

Password Generatorbrowser only

Passwords, passphrases and PINs are generated exclusively in your browser using its cryptographically secure random number generator. Checking your own password also runs only locally. None of it is sent to the server, stored or written into the address bar. No cookies are set and no data is stored in the browser.

htpasswd Generatorbrowser only

User names and passwords are processed exclusively in your browser; the hashes are created there (bcrypt in a background process of the browser). None of this is sent to the server, stored or written to the address bar. No cookies are set and no data is stored in the browser.

Hash Generatorbrowser only

Texts, files and HMAC keys are processed exclusively in your browser and are not sent to the server; files are also only read locally. No cookies are set and no data is stored in the browser.

JSON Formatterbrowser only

The JSON you enter or open from a file is processed exclusively in your browser and is not sent to the server. Opening files and downloading also happen locally. No cookies are set and no data is stored in the browser. “Share link” stores the JSON only in the part after the #, which is not sent to the server.

YAML Viewer & API Testerbrowser only

The YAML data – pasted or opened from a file – is read, converted and displayed exclusively in your browser; it is not sent to the server and not stored. If the file contains an API description (OpenAPI/Swagger), you can send test requests: these are only sent when you click “Send request”, directly from your browser to the API address you entered or that is specified in the file – not via gutowski.org. As with any website visit, the operator of this API receives your IP address, browser information and the contents of the request (parameters, body, headers and any credentials you entered); that operator is responsible for the processing there. The referring page is not sent (no referrer), and cookies are not sent. Credentials and input remain only in the memory of this browser tab and are gone after closing it. The example API (JSONPlaceholder, jsonplaceholder.typicode.com) is also only contacted on click. No cookies are set.

Regex Testerbrowser only

Expression, test text and replacement are processed exclusively in your browser and are not sent to the server. With “Share link” the current state can be copied as a link; your input is stored in the anchor part of the address (after the #), which browsers do not send to the server. No cookies are set and no data is stored in the browser.

Base64 Encoder / Decoderbrowser only

Entered texts and opened files are encoded or decoded exclusively in your browser and are not sent to the server. Image preview and download are also created locally. No cookies are set and no data is stored in the browser. “Share link” stores the input only in the part after the #, which is not sent to the server.

URL Encoder / Decoderbrowser only

Entered texts and addresses are encoded, decoded and broken down exclusively in your browser – they are neither sent to the server nor opened. No cookies are set and no data is stored in the browser. “Share link” stores the input only in the part after the #, which is not sent to the server.

HTML Entitiesbrowser only

Entered texts are encoded or decoded exclusively in your browser and are not sent to the server. When removing HTML tags, the code is only read as an inactive document – scripts are not executed and images are not loaded. No cookies are set and no data is stored in the browser. “Share link” stores the input only in the part after the #, which is not sent to the server.

CSS Minifierbrowser only

CSS you paste or open from a file is processed exclusively in your browser and is not sent to the server. The gzip measurement and the download also run locally. No cookies are set and no data is stored in the browser. “Share link” stores the CSS only in the part after the #, which is not sent to the server.

UUID Generatorbrowser only

UUIDs are generated exclusively in your browser using its cryptographically secure random number generator; names for v5/v3 and checked UUIDs are also only processed locally. None of this is sent to the server or stored. No cookies are set and no data is stored in the browser.

Cron Generatorbrowser only

Cron expressions and commands are evaluated exclusively in your browser and are not sent to the server. The list of next runs uses the time and time zone of your device. No cookies are set and no data is stored in the browser. “Share link” stores the expression and command only in the part after the #, which is not sent to the server.

Unix Timestamp Converterbrowser only

Timestamps, dates and lists are converted exclusively in your browser; time zones come from your browser’s built-in time zone database. None of it is sent to the server or stored. So that you can share a link to your conversion, the timestamp, date, unit and time zone are stored in the # part of the address – the browser does not send this part to the server. No cookies are set and no data is stored in the browser.

Redirect Generatorbrowser only

The addresses you enter are processed exclusively in your browser; the test does not open any address either, it only simulates the rules. No data is sent to the server, no cookies are set and nothing is stored in the browser. With “Share link”, your input is placed in the # part of the address – this part is not sent to the server by the browser.

HTTP Status CheckServer

Your browser sends the addresses you entered to my server in batches of at most 10. The server fetches each address once (with “Follow redirects” also the redirect targets, at most 5) and returns only the status code, redirect target, response time, HTTP version, file type, size and the headers Server, X-Robots-Tag, Cache-Control and Retry-After to your browser. The page contents are discarded after retrieval and not stored. The websites fetched see the IP address of my server, not yours. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page view. The status code glossary and the CSV export run only in your browser.

Redirect CheckerServer

Your browser sends the address you entered to my server. The server fetches it and follows the redirects step by step (at most 10); with “Check all variants” the variants with http/https and with/without www of the same address are fetched as well. Depending on your choice, the server identifies itself as a browser, smartphone (each with the suffix “gutowski.org-RedirectCheck”) or Googlebot. Only status codes, redirect targets, response times and individual headers are returned; from the final page only the title, canonical, a meta refresh and a hint at JavaScript redirects are read. The content is then discarded and not stored. The fetched websites see the IP address of my server, not yours. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page request. With “Share link”, the address is placed in the # part of the link, which is not sent to the server; the check is only started when the link is opened.

DNS LookupServer

Your browser sends the domain or IP address you entered to my server. The server queries the DNS records over an encrypted connection (DNS over HTTPS) at a public DNS resolver – depending on your selection Cloudflare (Cloudflare, Inc., USA), Google (Google LLC, USA) or Quad9 (Quad9 Foundation, Switzerland); when comparing, at all three. These providers learn the queried domain and the IP address of my server, not yours. If the resolvers are not reachable, my hosting provider’s resolver is used instead. The result is returned to your browser and evaluated there; nothing is stored. To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page view. With “Share link”, the query is stored in the # part of the link, which is not sent to the server.

WHOIS LookupServer

Your browser sends the domain or IP address you entered to my server. The server queries it at the responsible registry – via RDAP (over HTTPS) or via WHOIS (port 43), and additionally at the registrar if needed. The server takes the responsible registry from the public IANA lists, which are cached on the server for up to 24 hours. The registries learn the queried domain and the IP address of my server, not yours. The response is passed on unchanged to your browser and evaluated there; it is not stored. It may contain personal data to the extent that the registry makes it publicly available (e.g. registrant details for individual domain extensions). To prevent abuse, the number of your requests is limited: for this purpose, an irreversible hash of your IP address with a daily changing key is stored on the server for a maximum of 10 minutes. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the tool and protecting it against abuse. Calls to the interface also appear in the server log files like any page view. With “Share link”, the query is stored in the # part of the link, which is not sent to the server.

My IP AddressServer

When the page loads, your browser asks my server which IP address and which details (including user agent and language) it sees for you; the server only sends this information back to you and does not store it (except, as with every page request, in the server log files and as a hash for rate limiting, for a maximum of 10 minutes). Only when you click “Look up hostname” does my server query the name for your IP address at Cloudflare (Cloudflare, Inc., USA) via DNS over HTTPS; the reverse name contains your IP address. Only when you click “Show network & provider” does my server query your IP address at the responsible regional Internet registry (e.g. RIPE NCC, Netherlands; ARIN, USA; APNIC, Australia). The legal basis for the display is Art. 6(1)(f) GDPR, for the queries on click Art. 6(1)(a) GDPR (you trigger them deliberately). The details under “What your browser reveals” are only read in your browser and are not transmitted.

Color Converterbrowser only

Color values are converted exclusively in your browser and are not sent to the server. The eyedropper uses a function of your browser and only reads the color value of the point you click. No cookies are set and no data is stored in the browser. “Share link” stores the color only in the part after the #.

Contrast Checkerbrowser only

The color values are evaluated exclusively in your browser and are not sent to the server. No cookies are set and no data is stored in the browser. “Share link” stores the colors only in the part after the #.

Favicon Generatorbrowser only

Uploaded images are read exclusively in your browser and converted to all sizes there; they are not sent to the server. The ZIP file is also created locally. No cookies are set and no data is stored in the browser.

QR Code Generatorbrowser only

The QR code is calculated entirely in your browser. Input such as Wi-Fi passwords, contact details or an uploaded logo is not sent to the server and not stored. PNG and SVG files are also created locally. No cookies are set.

Audio Converterbrowser only

The audio file is read, converted and re-encoded exclusively in your browser; it is not sent to the server and not stored. The finished file is also created locally. No cookies are set.

10. Links to other providers

This website contains simple links to external services, e.g. YouTube, the App Store, Google Play or Amazon. Merely visiting this website does not transmit any data to these providers. Only when you click a link do you leave this website; the respective provider is then responsible for processing your data.

11. Your rights

Insofar as I process your personal data, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

To exercise your rights, an informal message to gabriel@gutowski.org is sufficient.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). In particular, the authority at your place of residence or the authority responsible for me is competent:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart
www.baden-wuerttemberg.datenschutz.de

13. Changes

I update this privacy policy whenever the website or the legal requirements change. The version published here applies.

Last updated: 20 October 2026