How I built 15 browser tools with zero backend

Chilam Chan — Wed, 16 Sep 2026 04:06:18 +0000

Every "free online tool" I reached for wanted an upload, an account, or both. So I built 15 that need neither — and the constraint that made that possible turned out to be the best decision in the project: no backend at all.

Here's what runs where.

The browser can do more than we give it credit for

Image work (HEIC→JPG, compress, resize, strip EXIF): <canvas> + createImageBitmap, and WASM (heic2any) for formats the browser can't decode natively.
PDF split/merge: pdf-lib, entirely client-side.
QR codes, password generation, JSON formatting, word counting: plain JS + crypto.getRandomValues and Intl.Segmenter.

Nothing touches a server. "Your files never leave your device" isn't a privacy promise you have to trust — it's just how the thing works. Open DevTools → Network and watch: no request fires when you convert a file.

Why no-backend is a superpower for a solo dev

$0 to run. A zero-dependency static site generator emits plain HTML; Cloudflare Pages serves it free. 272 pages (15 tools × 16 languages + hub) cost nothing.
Nothing to operate. No servers, no uploads to secure, no data to leak, no scaling. The whole "ops" surface is a git push.
It's genuinely private, which is a real differentiator when every competitor uploads your file to "process" it.

The tradeoffs (being honest)

No accounts, no cross-device sync, no server-side history. For utilities, that's fine — you do one thing and leave.
Some formats (TIFF, exotic codecs) the browser just won't decode; you draw the line and say so.
SEO is the whole growth engine, since there's no viral loop. That's the part I'm still figuring out.

If you're sitting on a "should this be a SaaS or just a tool" decision: a surprising amount can be just a tool, and shipping it that way is faster, cheaper, and more private.

Tools are here if useful: https://boring-tools-6ip.pages.dev — happy to go deeper on any part of the stack in the comments.

Stop pasting sensitive JSON into random online formatters

Chilam Chan — Tue, 15 Sep 2026 17:04:58 +0000

Every developer has done it: you get an ugly one-line JSON blob back from an API, and you paste it into the first "JSON formatter online" result to make it readable.

Here's the problem. Half the time that blob is a real response from your system — it can contain access tokens, internal IDs, customer emails, signed URLs, session data. The moment you paste it into a random web tool, you've sent that data to a server you don't control. You don't know if it's logged, cached, or sitting in someone's analytics pipeline.

For a side project, maybe you shrug. Inside a company with a compliance team, that's the kind of thing that ends up in an incident review.

The fix: format JSON in the browser, not on a server

You don't need a server to pretty-print JSON. Everything — parsing, formatting, validating, minifying — can happen entirely client-side with JSON.parse / JSON.stringify. The data never has to leave the tab.

// This is the whole "backend" of a JSON formatter:
const pretty = JSON.stringify(JSON.parse(input), null, 2);

A tool built this way can even work offline once the page has loaded, because there's nothing to call home to.

How to check if a tool is actually client-side

Don't take a site's word for it. Open DevTools → Network tab, paste your JSON, hit format, and watch:

No new request fires → the work happened locally. Safe.
A request goes out with your JSON in the payload → your data just left the building.

Do this once with any "online" dev tool that eats sensitive input (JSON, JWT decoders, "beautifiers", diff tools). You'll be surprised how many phone home.

What I ended up using

I got tired of doing that Network-tab check every time, so I built a JSON formatter that's 100% client-side — format, validate, minify, nothing uploaded, no signup:

👉 https://boring-tools-6ip.pages.dev/json-formatter/

It's part of a small set of no-upload browser utilities I'm building solo. If you deal with sensitive payloads regularly, the "does this leave my machine?" habit is worth building regardless of which tool you land on.

What's your rule of thumb for pasting real data into third-party dev tools? Curious how others draw the line.

DEV Community: Chilam Chan