Privacy policy
Last updated September 26, 2026
The short version
nestoo has no user accounts and doesn’t keep a database of what you enter. Tools that can run in your browser never send your input to us. Lookups that need a server are processed only to show you the result.
Tools that run in your browser
The password generator, password strength checker, hash generator, JSON formatter, Base64 and URL encoders, JWT decoder, UUID generator, timestamp, binary, text, QR code, percentage and unit tools work entirely on your device. Their input is never transmitted to nestoo.
The password strength checker can also check whether a password appears in known data breaches, but only when you click the button. It then sends the first five characters of the password’s SHA-1 hash to the Have I Been Pwned service and compares the answer on your device, so neither the password nor its full hash leaves your browser.
Tools that run on our server
IP lookup, DNS lookup, WHOIS, the port checker, HTTP header checker and SSL checker send the domain, IP address or URL you enter to our server, which performs the lookup and returns the result. We don’t store these queries. To prevent abuse, your IP address is kept in memory for about a minute to enforce request limits.
To answer DNS queries our server uses the public resolvers of Cloudflare (1.1.1.1) and Google (8.8.8.8); WHOIS and RDAP queries go to the registry responsible for the domain or IP address.
What is my IP
To show both your IPv4 and IPv6 address, your browser contacts Cloudflare’s public 1.1.1.1 service, which answers with the address it sees. Your approximate location is looked up in a database stored on our server.
Hosting and logs
nestoo runs on Railway and may be delivered through Cloudflare’s network. Like any web server, they can record technical request data – IP address, requested page, browser type and time – in short-lived logs used for security and troubleshooting.
Analytics
We may measure visits with privacy-friendly analytics that doesn’t use cookies and only reports aggregated numbers, such as how often each tool is used. This helps decide which tools to improve.
Ads and affiliate links
Some pages may show ads from Google. Google and its partners can use cookies or similar technologies to serve and measure ads; in the European Economic Area, the UK and Switzerland they ask for your consent first, and you can change your choice at any time via the privacy settings link shown with the consent message. See how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
Recommendations labelled as sponsored are affiliate links: if you buy something after clicking one, nestoo may earn a commission. The partner’s site may set its own cookies.
Cookies and local storage
nestoo itself only stores your language and colour theme preferences in your browser. Everything else depends on the ads and analytics described above.
Your rights and contact
Under the GDPR you have the right to access, correct and delete your personal data and to object to its processing. Since we don’t keep personal data beyond the short-lived logs described above, there’s usually nothing stored about you. For any privacy question write to [email protected].