FORGE is a static site served from Cloudflare Pages, with a small Cloudflare Worker that proxies a handful of public threat-intel feeds and does basic, privacy-preserving usage logging. This page tells you exactly what happens to your data, tool by tool, with nothing left out.
| Tool | What you input | Where it goes |
|---|---|---|
| Email Header Analyzer | Raw headers | Stays in your browser |
| IOC Extractor (paste/file) | Text, logs, CSV, JSON, EML, PDF | Stays in your browser — PDFs are parsed locally via pdf.js, EML files are parsed locally |
| IOC Extractor (URL fetch) | A public URL you paste | Fetched server-side by a Cloudflare Worker (/api/fetch-url) so your browser doesn't hit CORS errors, then the response is returned to your browser and parsed locally. The Worker does not store the fetched content. |
| Hash Lab (generate hashes) | Text or files | Stays in your browser (WebCrypto API) |
| Hash Lab (bulk hash lookup) | MD5/SHA1/SHA256 hashes you paste | Each hash is sent to VirusTotal via a Cloudflare Worker proxy (/api/hash-lookup) to look up the known SHA256 and detection verdict. Only the hash itself is sent — never your files or text. |
| Threat Intel Checker (IP reputation lookup) | IPv4 addresses you paste | Each IP is sent to VirusTotal via a Cloudflare Worker proxy (/api/ip-lookup) for reputation, ASN/owner, and detection stats. The same IP is also cross-referenced against AbuseIPDB, GreyNoise, and AlienVault OTX where those are configured on this deployment, shown as extra cards on the same result — never as a separate paste or a redirect off FORGE. |
| Threat Intel Checker (domain reputation lookup) | Domain names you paste | Each domain is sent to VirusTotal via a Cloudflare Worker proxy (/api/domain-lookup) for reputation, categories, and detection stats. Domains and hashes are also checked against AlienVault OTX for community threat-pulse references. |
| AI Log Explainer | A log line, alert, or command you paste | Sent to Cloudflare Workers AI (a model running on Cloudflare's own infrastructure, the same provider hosting this site) for a plain-English explanation. FORGE does not store your input; it is processed only to generate the response. Capped at 4,000 characters and rate-limited. |
| IOC Extractor (URL reputation lookup) | URLs you paste | Each URL is sent to VirusTotal via a Cloudflare Worker proxy (/api/url-lookup) to check its existing scan verdict. FORGE never submits new URLs to VirusTotal for scanning — only previously-scanned URLs return a result. |
| Decoder | Encoded strings | Stays in your browser |
| Subnet Calculator | CIDR notation | Stays in your browser |
| Regex Tester | Patterns + text | Stays in your browser |
| Vulnerability Intelligence (KEV feed) | None (you just browse it) | Fetched server-side from CISA's public KEV catalog, cached briefly at the edge. CVE IDs from that feed are also looked up against the National Vulnerability Database (NVD) to show real CVSS severity; only the CVE ID is sent, and results are cached at the edge for 30 days since a published CVSS score never changes. |
| Live threat feed | None (you just browse it) | Fetched server-side from URLhaus and Shodan InternetDB, cached briefly at the edge |
FORGE keeps only aggregate, non-identifying usage analytics — never a per-request log tied to you, and never the indicators you look up. For each page view or tool use we record a single anonymous data point holding only: which page/tool was used, your country, the referring site's host, and whether you're on mobile or desktop. The IP address, hash, domain, or URL you paste into any lookup is never recorded. There are no cookies and no per-visitor identifier.
These aggregate metrics are stored in Cloudflare Analytics Engine (counts only) and, where enabled, Cloudflare Web Analytics — both cookieless, with no per-visitor records. Rate-limit counters (e.g. "how many VirusTotal lookups this day") hold numbers only, to keep the free-tier quotas fair across everyone.
Don't take our word for it. Open your browser's DevTools (F12 or Cmd+Opt+I) → Network tab, then use any of the client-side tools above (Email Headers, Hash Lab, Decoder, Subnet Calc, Regex Tester, or IOC Extractor without the URL-fetch option). You should see zero outgoing requests while you work — the processing genuinely happens on your machine.