Short version
Runs in your browser. Nothing you paste or open is uploaded. There is no account, no tracking and no analytics.
What happens when you press Check
- Your FSH stays in the page. SUSHI runs in a Web Worker in your browser tab.
- The browser downloads public FHIR packages (for example hl7.fhir.r4.core 4.0.1) from packages.fhir.org and keeps them in IndexedDB. Those requests contain only package names and versions, never your FSH.
- Results are drawn in the page. Nothing is saved on a server. There are no share links.
How this is enforced
The site sends a Content Security Policy that only allows connections to the site itself, packages.fhir.org and packages2.fhir.org. Even if there were a bug, the browser would block a request anywhere else.
SUSHI runs in a Web Worker, and a worker follows the policy sent with its own script (MDN: CSP in workers). Two of SUSHI's dependencies (terser and ajv) build functions from strings, so the worker's policy allows 'unsafe-eval'. The worker cannot touch the page, its network limits are the same as the site's, and the pages themselves never allow 'unsafe-eval'.
The V2 Message Explainer
The V2 Message Explainer is a page of its own (/hl7v2/) with a stricter policy. It needs no network at all, so its policy sets connect-src 'none' and turns on Trusted Types, and the page cannot be put inside a frame. Messages are explained in the page and never saved to browser storage.
The validator
The HL7 FHIR Validator needs Java and does not run in a browser. The toolkit never calls a public validator service. A command-line tool, not available to download yet, will run it on your own computer.
Please do not paste patient data
The toolkit is for profiles, examples and test data. Never paste real patient data into any online tool.
Your browser's copy
To remove the cached packages, clear site data for the toolkit in your browser settings.