How sharing works: nothing is stored
A BackendBench share link is your tool state, packed into the link itself. The page that opens it unpacks it in the browser. There is no database, no account and no short URL service, so there is nothing to leak.
Try it
This demo runs the same encoder that the Share buttons use. Nothing you type here leaves your browser.
What happens when you press Share
- The tool collects the inputs that differ from their defaults, such as the pattern, the text and the flags of the regex tester.
- The values are scanned for secrets. If anything looks like a password, token or private key, sharing stops with an explanation.
- The remaining state is written as JSON, compressed with a small LZ77 coder and encoded as URL-safe base64. It must fit in 2048 characters.
- The result is placed after the
#s=in the address. The part of a URL after the hash is never sent over the network. - You can copy the link, open your phone's share sheet, or copy a Markdown summary for a pull request or Slack message.
When someone opens the link, the tool decodes the fragment, checks it, fills in the inputs and runs. If the link was cut off or edited, the check fails and the tool simply opens empty.
Tools with a Share button
The share bar appears under the input of every tool that keeps its state in the form, which is most of them. These are the ones people share most:
- Cron builders (Quartz, Spring, Unix and more)
- JSONPath tester
- Regex tester
- Diff checker
- JSON to Java
- Thread dump analyzer
- Stack trace beautifier
- Time zone converter
- curl converter
- SQL formatter
- JSON diff
- DDL to JPA entity
Cron expressions keep their short link form (?e= and ?z=), and now also offer the share sheet and a Markdown copy.
What is never shared
Some tools exist to handle secrets. They have no link, and they also keep your input out of the address bar:
- JWT decoder
- JWT builder & verifier
- bcrypt generator & verifier
- Password generator
- TOTP generator
- PEM & X.509 decoder
- Hash generator
- UUID generator
- Smart decoder
Everywhere else, a value that looks like a JWT, a bearer token, an AWS key, a private key, a password assignment or credentials inside a URL blocks the Share and Markdown buttons. The check is a safety net, not a guarantee: read what you are about to post before you send it. A sample curl command with a real token, for example, must be edited first.
Frequently asked questions
Is anything stored on a server when I share a link?
No. The link contains your input itself, compressed and encoded, in the part after the # sign. Browsers never send that part to a server, so BackendBench never sees it and cannot store it. If you delete your copy of the link, the state is gone.
Why is there a size limit on shared links?
Long links break in chat apps, email clients and some browsers. A shared link holds at most 2048 characters after compression, which fits a few paragraphs of text, a thread dump excerpt or a modest JSON document. For anything bigger, use Copy as Markdown, which pastes the input and result directly.
Why does the Share button refuse some content?
Links end up in chat logs, browser history, tickets and screenshots. If your input looks like a password, token, private key or an Authorization header, the Share button refuses to embed it and tells you why. Tools that exist to handle secrets, such as the JWT tools and the password generator, have no share link at all.
What is Copy as Markdown?
It builds a short message for a pull request, issue or Slack thread: the tool name, the link, your inputs in code blocks and the result. It is plain text that you paste yourself.
Can someone change my shared state or inject code through a link?
A link is decoded with strict checks: a checksum, a size limit, a fixed set of allowed field names and a check that it belongs to the same tool. Anything tampered with or malformed is ignored and the tool opens normally. Values are only ever placed into input fields, never run as code or inserted as HTML.