What this is for
Built for the common good
disarm exists to help people defend against text attacks they have not seen before — the ones with no signature to match and no name yet. It is free, open source, and built in the open. This page says what that commits us to, and what it rules out, because a project that demonstrates attacks in order to defend against them should state its position rather than leave it to be inferred.
Acceptable use
This is defensive work. The library and these tools exist so that the people receiving hostile text can see it, understand it and neutralise it. That is the whole purpose, and every design decision follows from it: the tools report what they changed, they name the characters they found, and they explain the mechanism rather than hiding it behind a verdict.
The concrete audience is the blue team — the engineers and defenders who own the input validation, the moderation queue, the filename handling and the code review. But the framing is broader than any one side of an exercise. Novel attacks are found and fixed by whoever meets them first, and the knowledge is worth more shared than hoarded.
What this project does not endorse
There is no endorsement, encouragement or advocacy here for building malicious tooling. Nothing on this site is offered as a recipe for attacking anyone, and we will not help make one. That applies to contributions, to issues, and to the way these pages are written.
We are also not going to pretend that is the end of it. This is a tool, and like any tool it can be misused. Every page here shows an attack working before it shows the defence, because a defence you cannot see the need for is a defence nobody deploys. That means the same page that teaches you to recognise a Trojan Source commit also shows you what one looks like. We think that trade is correct — the technique is publicly documented, the attackers already have it, and the defenders are the ones currently missing it — but it is a trade, and saying so plainly is more honest than a disclaimer that pretends otherwise.
What we ask in return is simple. Use it on text you are responsible for. Report what you find, so the next person does not have to find it again. The issue tracker is open, and several of the characters disarm folds are there because somebody sent in a string that got past them.
Privacy, and why there is no cookie banner
There is no cookie banner because there are no cookies. That absence is deliberate, and it is the visible end of a set of choices worth stating outright rather than leaving you to infer from what is missing.
| What this site does | Detail |
|---|---|
| Sets no cookies | None, of any kind. Not for preferences, not for sessions, not for measurement. |
| Runs no advertising | There are no ad networks, no trackers and no third-party scripts of any sort. The tools load nothing but their own code. |
| Collects no behavioural data | No analytics, no session recording, no fingerprinting, no A/B testing. |
| Stores no personal data | There are no accounts, so there is nothing to store. We cannot tell you apart from anyone else and have not tried. |
| Never receives the text you paste | Every tool runs disarm compiled to WebAssembly, inside your browser. Your text is processed on your own machine and is never sent anywhere. |
Do not take our word for it
A privacy claim you cannot check is just a sentence. These are all verifiable from where you are sitting:
- Open your browser's network tab and use any tool. You will see the page, its stylesheet, its script and the WebAssembly engine load, and then nothing further, however much text you paste.
- Check your cookie jar for
disarm.dev. It is empty. - Read the source. Every page, every script and the WebAssembly wrapper are in the site repository, and the library itself is in raeq/disarm.
- Work offline. Load a tool, disconnect, and keep using it. It has everything it needs.
The one thing worth knowing
The tools can produce a shareable link, and that link carries your text in the
URL #fragment. Browsers never transmit a fragment — everything
after the # is stripped before the request leaves your machine
— which is exactly why it is stored there rather than in a query string.
The text reaches whoever you send the link to, and nobody else. It is still a
link with your text in it, so treat it the way you would treat the text.
Being static and cookie-free, this site does not need a consent banner under the ePrivacy Directive or the GDPR, since it stores nothing on your device and processes no personal data. We are telling you that because the reasoning behind an absent banner should be legible, not because a lawyer asked us to.
Free, and open
disarm is MIT licensed, and so is this site. The tools are free with no account, no rate limit and no paid tier, and there is no plan to add one. It is built by people who kept hitting these problems and got tired of solving them badly, for other people in the same position.
The code samples on every tool page are compiled and run in CI across seven languages, so what you copy is what was tested. If you find a string any of this handles wrongly, the most useful thing you can do is say so.