I built 85 online tools that run 100% in your browser — no backend, no uploads

MichelDavi — Wed, 09 Sep 2026 03:31:23 +0000

Hey folks, I came here to share a project/product I built: a free international portal of online tools called Kastavo.

The idea for Kastavo came from wanting to help some people — and myself too — by having a safe place to do some important tasks, like compressing an image, for example. I always had this fear of downloading a file and filling my PC with viruses — even more so since I use it for programming and stuff.

The decision that defines the project: zero backend, everything runs in the browser. There isn't a single server route. That gives me two things: first, real privacy — the user's file never leaves their device; and second, zero cost to process, even if traffic grows.

I wanted to cover several categories in it: from simple calculators to financial ones, dev tools, validators, converters to PDF, and other tools.

I'll share a few things I did that I found interesting, and some headaches I went through.

To deal with password-protected PDFs, I use QPDF compiled to WASM. Two behaviors happened that weren't documented anywhere: the main function throws the error code instead of returning it, and the only way to capture the text log was to swap the global console.log before initializing the module. I only found this out by testing the compiled module by hand — reading the types wouldn't tell you.

Another thing: components that generate random values, like passwords and UUIDs, were generating one value on the server and a different one on the client on the first render. Since the two didn't match, React discarded the tree and re-rendered. It only showed up when testing in a real browser — neither TS nor the unit tests catch this kind of thing. That's what showed me you can't rely on automated tests alone; there was a lot of manual testing to hunt down bugs like this.

A problem I ran into along the way was XSS — Cross-Site Scripting. At first I thought it wouldn't affect me since I have no server and no database, but I realized it's kind of the opposite: since everything runs in the browser and I handle what the user types, XSS (JS injection) is the class of bug that actually makes sense for me to worry about — not, say, SQL injection. Since I have no login and no other users' data, the impact is limited, but even so it was good to understand it and be careful with how I render input.

It's not a perfect product, but as my first personal project actually launched — with a bought domain, hosting, and everything — I thought it was really cool and learned a lot. It's a portal that took me about 2 months to build, plus days of setup to launch and a few more deploys in a rush fixing whatever came up.

Today it has 85 tools in 3 languages, and I plan to keep adding useful tools and fixing bugs and issues I find.

It's live at kastavo.com — any feedback is very welcome: suggestions, criticism, and bugs too.

Feel free to use Kastavo!

DEV Community: MichelDavi

I built 85 online tools that run 100% in your browser — no backend, no uploads