Built 50 privacy-first web tools that run entirely in your browser—no servers, no tracking, just useful tools. Tooljar.app

Burak ELDEK — Sun, 14 Jun 2026 17:05:26 +0000

Most "free online tools" share a dirty secret: you upload your PDF, image, or text to their server. For a contract, an ID scan, or a private spreadsheet, that's a real privacy problem — your file now lives on someone else's machine.

So I built Tooljar — 50+ everyday utilities that do all their work inside your browser. No uploads, no accounts, no ads, and it keeps working offline. If a tool processes a file, that file never leaves your device.

What's in it

50 tools across PDF, image, text, developer, design and security categories. A few I lean on daily:

PDF Compressor and Merger/Splitter — re-compress and reorganize PDFs locally with pdf-lib + PDF.js.
Image Converter and EXIF Remover — convert HEIC/PNG/WebP and strip GPS/camera metadata via Canvas.
JSON Editor, Regex Tester, JWT Decoder — the dev daily-drivers.
Password Strength — entropy + pattern detection, with an optional Have I Been Pwned check using k-anonymity (only the first 5 chars of the SHA-1 hash are ever sent).

How it works

The whole thing is a static site — no backend at all. Heavy lifting happens in the browser:

PDFs: pdf-lib for writing, PDF.js for reading, run inside a Web Worker so the UI stays responsive on big files.
Crypto/security: the native WebCrypto API for hashes, HMAC, JWT signature verification and the password tooling.
Images: re-encoding (which conveniently drops EXIF), plus heic2any for iPhone HEIC.
i18n: every tool ships in English, Turkish, German and Russian, statically rendered (204 pages) so each language is independently crawlable.

Things I learned

Web Workers are non-negotiable for file tools — a 50 MB PDF will jank the main thread otherwise.
k-anonymity is underrated: you can check a password against breach databases without ever sending the password — hash it, send 5 characters of the prefix, match the suffix locally.
Shipping 50 tools × 4 languages = 200+ static pages needs a real i18n build pipeline (and a per-page audit), or translations silently rot.
Client-side is a feature, not a limitation — "your files never leave your device" turns out to be the most compelling thing about the whole project.

Try it: tooljar.app. It's free and there's nothing to sign up for. I'd love feedback on which tool to build next, or edge cases where one breaks.

DEV Community: Burak ELDEK

Built 50 privacy-first web tools that run entirely in your browser—no servers, no tracking, just useful tools. Tooljar.app