Why every tool on this site runs in your browser
By Huzaifa Awais ·
Search for “merge PDF” and almost every result asks you to upload your files. For a recipe card that is fine. For a signed contract, a bank statement or a medical report, it means a copy of the document now exists on a server you know nothing about.
Browsers have been able to do this work themselves for years. Every tool on this site uses that ability, and this post explains how, and where it stops.
What the browser can already do
- PDFs. The open-source pdf-lib library reads and writes PDF files in JavaScript. Merging, splitting, rotating, numbering and watermarking are all object manipulations that never need a server.
- Images. The Canvas API decodes JPEG, PNG and WebP, and can re-encode them at a chosen quality. That covers compression, resizing, cropping and stripping EXIF metadata.
- Cryptography. The Web Crypto API provides SHA-2 hashing and a cryptographically secure random number generator, which the hash, UUID and password tools use.
What it costs
The trade-off is weight. pdf-lib alone is several hundred kilobytes. Loading it on every page would make the whole site slow, so each category’s code is split into its own bundle, and heavy libraries are only fetched the moment you press the button that needs them. The directory page loads almost no JavaScript at all.
The other cost is that your device does the work. A 200-page scan takes longer on an old phone than on a server. For the sizes most people deal with, the difference is a second or two.
Where it stops
A browser cannot freely read other websites, the same-origin policy blocks it, for good reasons. So the one tool that inspects a live website’s HTTP headers offers two modes: paste the headers yourself (fully local), or let this site’s small PHP endpoint fetch them. That endpoint is the only server-side code here, and the next post explains how it is protected.
How you can check
Open your browser’s developer tools, switch to the Network tab and run any file tool. You will see the page’s own scripts load, and no request carrying your file.