Privacy
What actually happens when you use a tool on drwho.me, tool by tool.
Tools that run in your browser
A tool marked "runs in your browser" sends the lookup from your browser straight to a public service: Cloudflare DNS over HTTPS at cloudflare-dns.com for DNS records, or crt.sh for certificate logs. The domain you look up never reaches drwho.me.
Tools that run on our server
A tool marked "runs on our server" sends the domain to the drwho.me server, which runs the check and returns the result. The server does not store the domain.
What is my IP, and IP lookup
These two send an IP address to ipinfo.io to get its location and network. For "What is my IP" that address is yours; for "IP lookup" it is whichever address you typed in.
Developer tools
Base64, the JWT decoder, the JSON formatter, the URL encoder and the UUID generator all run entirely in the page. Whatever you type into them never leaves your browser.
Rate limiting
The server keeps a short-lived, in-memory count of requests per visitor address, used only to stop one address from making too many checks in an hour. Nothing else is built from it, and it is not kept.
Accounts
drwho.me has no accounts, no sign-up and no login.
Analytics
The site uses Google Analytics (GA4) to count page views and events. For visitors in the EEA, the UK and Switzerland, this is off until you agree to it. Links from drwho.me to Domain Posture carry UTM tags so we can see which tool sent the click. We send which tool ran and whether it found a problem, never the domain, address or text you entered.
Cloudflare also adds its Web Analytics script to the pages. It counts visits and page speed without cookies and does not follow you across sites.
Hosting
drwho.me sits behind Cloudflare, which fronts and caches the site.