TL;DR: Browser converters see whatever you paste for that session. Do not submit passwords, personal IDs, or confidential work into public tools—use offline methods for sensitive text.
What online tools typically process
Client-side JavaScript may encode entirely in your browser without uploading. Still assume shoulder surfers and shared devices see screen content.
Sensitive content categories
Passwords, API keys, student PII, unreleased product names under NDA, medical details—keep off recreational cipher sites regardless of HTTPS padlock.
Shared and lab computers
Close tab after use. Clear browser history if policy requires on school machines. Incognito helps but is not magic on managed Chromebooks.
Classroom encoded messages
Use fictional names and silly phrases in demos—not classmates’ real addresses even “as a joke.”
HTTPS and padlocks
Encryption in transit protects from network eavesdropping, not from the site operator if data were sent server-side. Prefer tools that state client-only processing.
Screenshot sharing risk
Discord screenshot of encoded secret still leaks if friends decode. Treat encoded as obscured not encrypted.
Corporate environment
Some employers block paste into external sites via DLP. Use approved internal tooling for work documents; letterstonumbers.com for personal puzzle hobby only on work laptop if policy allows.
Teaching digital citizenship
Cipher unit moment to discuss data minimization—fun lesson, serious habit.
Offline alternatives for secrets
Paper strip cipher, local Python script without network—better for actual confidentiality needs.
Parent letter snippet
“Our class uses a public converter for homework words only—no personal information required.” Reduces district privacy officer concerns.
Client-side processing assumption
Reputable converters process in browser without account—but shoulder surfers and shared devices still see screen content.
Categories never to paste
Passwords, API keys, student PII, unreleased product codenames—keep off recreational cipher sites regardless of HTTPS.
Corporate DLP environments
Some employers block external paste—use https://letterstonumbers.com/ on personal devices for puzzle hobby if work laptop restricted.
Parent letter privacy snippet
Class uses public converter for vocabulary words only—no personal information required. Reduces district privacy officer concerns.
Offline paper alternative for secrets
Actual confidentiality needs paper strip cipher or local script without network—not obscured A1Z26 online.
A student ID that never goes into the box
A student ID is a number already. Encoding it with A1Z26 is a category mistake and a privacy mistake. The ID does not need to become letters, and the letters of a student’s address do not need to become a practice row. Choose the practice sentence before class and keep it generic. “FIND THE KEY” is enough. If a student pastes an ID because the box was empty and they wanted to try something, clear the field, say why, and use FIND instead. FIND is 6 9 14 4. The lesson continues. The ID does not.
Write the ban on the board as a list of kinds, not a lecture: ID numbers, passwords, addresses, medical words about a real person, and full names paired with grades. The list is short so it can stay up while people work. A ban that lives only in a syllabus paragraph will be forgotten by the time the converter loads.
Shoulder view of a library computer at lunch
A library computer faces a walkway. Whatever you paste is readable over your shoulder for as long as it stays on the screen. Encode a practice word such as SHELF, 19 8 5 12 6, and then clear the field before you stand up. Do not leave SHELF up either if the next person should get an empty box. The habit is clear-on-stand, practiced on harmless words, so it exists when the text is sensitive. You do not practice the habit for the first time on the day you are holding a private sentence.
If the machine is shared and you cannot guarantee the field cleared, do the encode on paper. The alphabet strip does not broadcast to the walkway. Paper is the right tool whenever the screen is public and the text is not. The converter is for practice sentences you would happily leave on the projector.
Offline strip for the one clue that is actually private
When a clue really is private, such as a family combination you were asked not to spread, do not type it to “see what the numbers look like.” Encode it with a paper strip at home, use it, and destroy the scrap. The online box is for public practice such as KEY, which is 11 5 25. The split between those two tools is the whole privacy lesson. Students can repeat it: public words in the browser, private words on paper, scrap destroyed.
Check the scrap was destroyed by asking to see the blank notebook page, not by asking the student to recite the private value. Reciting it undoes the point. A blank page, a cleared browser field, and a practice encode of KEY are the three artifacts of a careful session. Anything else is leftover risk.
Projector test with the word SHELF only
Before students sit at library machines, put SHELF on the classroom projector and ask whether this word is allowed in the converter. It is. 19 8 5 12 6 is a practice row, and the word is not anyone’s secret. Then ask about a home address. It is not allowed. The contrast takes a minute and it gives the room a yes and a no, which is easier to remember than a paragraph of policy. Leave SHELF on the projector while they work so the allowed example stays visible.
At the end, clear the projector too. A allowed word left on a screen overnight teaches the opposite of clear-on-stand. The teacher habit and the student habit are the same habit. If the projector is off and the library fields are empty and the only paper left is a blank scrap, the session matched the rule.
