This site tells you to be careful about where your text goes, and then asks you to paste text into it. That only works if the claims it makes about itself are checkable from your side of the connection.
Four checks. None takes longer than two minutes, and none needs anything you don't already have.
Open Check a paste. Open your browser's developer tools — F12, or Cmd+Option+I on a Mac — and select the Network tab with no filter applied. Reload once so it captures from the start.
Now paste something in and run the check. Watch the request list while you do it.
Requests after page load: 0
No fetch. No XHR. No beacon. No websocket.
The findings appear with the network panel
completely still. Detection runs in your browser, on your machine, against a rule list that was already downloaded as part of the page. There is nowhere for the text to go because nothing in the bundle is capable of sending it.
Open the site in a fresh private window with the Network tab open. Decline the cookie banner. Then browse anywhere you like and read the list of domains contacted.
Domains contacted: dontpastethat.com
That's the whole list. Fonts are served from
this origin, not Google's. No CDN, no icon
host, no embedded video, no analytics. The consent choice itself is stored in localStorage, not a cookie — so declining leaves you with no cookie from this site at all. Check Application → Storage if you want to confirm that too.
The pattern list is published as a file. The rules API serves the same file. If those two ever differed, the thing you audited would not be the thing that ran.
curl -s https://dontpastethat.com/patterndb.json | shasum -a 256 curl -s https://api.dontpastethat.com/v1/rules | shasum -a 256 Two identical digests. The API deliberately serves the file's original bytes rather than re-serialising them, so this comparison stays exact rather than approximate.
Every published version of the corpus is signed with Ed25519 over the file's exact bytes. The signature travels in a response header; the public key is served from this site.
curl -sI https://api.dontpastethat.com/v1/rules | grep -i x-rules-signature Then fetch both halves and verify them yourself:
curl -s https://dontpastethat.com/patterndb.json -o corpus.json
curl -s https://dontpastethat.com/rules-signing.pub.pem -o key.pem node -e "const{verify,createPublicKey}=require('crypto'),fs=require('fs');\
console.log(verify(null,fs.readFileSync('corpus.json'),\
createPublicKey(fs.readFileSync('key.pem')),\
Buffer.from(process.argv[1],'base64'))?'SIGNATURE OK':'SIGNATURE MISMATCH')" \
"<the base64 string from the header above>" SIGNATURE OK A single changed character anywhere in the corpus — including a version bump, including a metadata field nobody reads — invalidates that signature. There is no version of this that passes by being close enough.
A verification page that only lists wins is marketing wearing a lab coat. Here are the limits of each check, stated plainly.
You watched this build make no requests. A future deploy is a different build, and you would have to look again. What stands between those two moments is a build gate: the release script scans the compiled JavaScript for fetch, XMLHttpRequest, sendBeacon and WebSocket, and fails the build if any of them appear in the checker's bundle. That is an automated gate rather than a promise, but it is our gate, and you are trusting that it ran.
If you press Accept, Google Analytics loads and Google is then a third party that learns you were here. That is what the banner is asking. The claim is narrower and more useful than "we never share anything": nothing loads before you choose, and nothing loads if you decline.
Publishing the public key on the same domain that serves the corpus proves the file wasn't altered in transit, and lets you verify any mirror or cached copy against the original. It does not protect you against whoever controls this domain, because they could replace the key and the corpus in the same deploy.
What makes the signature meaningful against that is where the key gets pinned. Each client — the browser extension and the desktop app, as they ship — carries a compiled-in copy of the public key and refuses a corpus that fails to verify against it. At that point a swapped key on this origin is detected by every installed client rather than silently accepted. Today, with no shipped clients, check 4 is a transit and mirror check. Saying otherwise would be the kind of overclaim this site exists to argue against.
Claims decay when nobody is stopping them from decaying. Three things here are structural rather than intentional:
Then something here is wrong and we would rather hear it from you than not hear it. Tell Golonex, with the check number and what you saw instead. A page like this is worth exactly as much as its willingness to be corrected in public.