How WriteKeys keeps your text private

Last updated October 12, 2026

Case notes are full of protected health information. WriteKeys is built so that none of it ever reaches us. This page explains how, and how you can confirm it without taking our word for it.

Where your text goes

Nowhere. When you open WriteKeys, your browser downloads one page, a style sheet, a few small scripts, and the word list for the spell check. After that, everything happens on your device:

• The text sits in the text box in your open tab, and only there.
• The buttons run JavaScript in your browser. They change the text in place without sending it anywhere.
• The text is never written to cookies, local storage, or any other browser storage.
• Close the tab and the text is gone. There is no copy to delete, because no copy was made.

Your tools, word lists, and templates

If you make buttons under My tools, add words under My words (words to replace, such as ESRO with ESRD, words to autocomplete, or words for the spell check to ignore), or save Templates, WriteKeys saves them in your browser's local storage so they are still there next time, even after you close the browser. They are the only things WriteKeys saves, along with a few on/off settings. They stay in this browser on this device and are never sent anywhere; the same network block applies to them. In the spell check, Always ignore saves the word in the same way, on a list you can check under My words, Ignored words. Plain Ignore saves nothing: the word is forgotten when you close the tab.

• Anyone who uses the same computer and browser profile can open them.
• Clearing your browser's site data (“cookies and other site data”) deletes it. Some workplaces clear this automatically when you sign out.
• Don't add patient names, record numbers, or anything else that identifies a person. Keep word lists to misread words and abbreviations, and keep templates to outlines you fill in after inserting them.

What is switched off on purpose

• No accounts, analytics, ads, or third-party scripts. Every file the page loads comes from writekeys.net.
• No network connections. The page sends a Content Security Policy that tells your browser to block it from contacting any server after it loads, our own included. These are the rules that do it: connect-src 'none'; form-action 'none'.
• No form submissions. The text box isn't part of a form, and the policy would block a form from submitting anyway.
• No autofill memory. Autocomplete is off in the text box, so the browser doesn't keep or restore what you typed.
• The browser's spell check is off. Some browsers offer an “enhanced” spell check that sends text to an online service, so the browser's own spell check is off in the text box. WriteKeys checks spelling itself, in your tab: it looks each word up in a word list that downloads with the page, and nothing is sent anywhere.
• Grammar extensions asked to stay out. The text box carries the settings that Grammarly and LanguageTool look for to switch themselves off. Other extensions may not respect them; see below.

The full policy your browser receives:

default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; connect-src 'none'; form-action 'none'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests

Check it yourself

1. Work offline. Open WriteKeys, then turn off Wi-Fi or unplug your network cable. Paste some text and try every button. Everything still works, because nothing needs the internet.
2. Watch the network. Press F12 (Cmd+Option+I on a Mac) to open your browser's developer tools and choose the Network tab. Paste text and press buttons. No requests appear.
3. See what is saved. In the same developer tools, open Application (Chrome, Edge) or Storage (Firefox), then Local Storage for writekeys.net. You will find your tools, word lists, templates, and your settings for them, and nothing you typed in the text box.
4. Read the code. The scripts are short and not minified: app.js runs the page, and transforms.js holds the text rules.

HIPAA and your organization's rules

Because WriteKeys never receives, stores, or transmits the text you paste, no protected health information is disclosed to us. That is the design, and the steps above let you verify it.

WriteKeys can't decide for you whether a website is allowed at work. Many organizations limit which sites staff may use with patient information, whatever those sites do with it. Check your employer's policy, or ask your privacy or compliance officer, before you paste PHI into any website, this one included. If they want to review how WriteKeys works, send them this page.

Things outside our control

• Browser extensions. An extension allowed to “read and change data on the websites you visit” can see any text box on any site. Grammar checkers, AI writing assistants, and screen recorders are common examples. If your organization manages your browser, these are often already restricted.
• Your clipboard. Copy all puts the text on your computer's clipboard. Windows clipboard history (Windows key + V) and clipboard sync between devices can keep a copy after you paste. Clear the history if that matters on your computer.
• Shared computers. When you finish, press Clear and close the tab. Your tools, word lists, and templates stay in that browser, so delete anything you don't want to leave behind.

What our host can see

WriteKeys is served by Cloudflare. Like any web host, it handles routine request details such as your IP address, browser type, and the address of the page you asked for, in order to deliver the site and protect it from attacks. None of that includes the text in the box, which never leaves your browser. Details are in our privacy policy.

Questions about any of this: hello@writekeys.net.