DEV Community: Pure Life Tribe

Bulk Password Breach Check: Safe & Local Vault Auditing

Pure Life Tribe — Thu, 11 Jun 2026 06:03:35 +0000

Audit thousands of passwords against data breaches — completely in your browser with zero-knowledge privacy.

Published: June 9, 2026

TL;DR

Most bulk password checkers require you to upload your entire vault. Utilora’s Bulk Password Breach Checker uses HIBP’s k-anonymity + local hashing so your passwords never leave your device.

The Hidden Risk Most People Ignore

Using a password manager is excellent, but it’s not enough.

Many users unknowingly reuse or slightly modify passwords that have already been leaked in massive breaches (LinkedIn, Adobe, Yahoo, etc.). Manually checking hundreds or thousands of passwords is impractical — which is why people turn to bulk checkers.

The problem? Most bulk checkers ask you to upload your password list. That creates a massive new privacy risk.

How Utilora’s Zero-Knowledge Breach Checker Works

We built this tool using a privacy-preserving technique called k-anonymity (popularized by Troy Hunt of Have I Been Pwned).

Step-by-Step Technical Process:

Local Hashing — Your browser uses the WebCrypto API to create a SHA-1 hash of each password locally.
Prefix Only — Only the first 5 characters of the hash are sent to HIBP’s Range API.
Server Response — HIBP returns hundreds of matching hashes that start with the same prefix.
Local Comparison — Your browser checks if your full hash exists in the returned list.

Result: HIBP knows someone checked a password starting with ABC12, but has no idea which specific password it was.

Why You Should Audit Your Entire Vault Regularly

Discover weak or compromised passwords you forgot about
Clean up old reused passwords
Respond quickly after major breaches
Maintain good password hygiene across all accounts

Real-World Scenarios

You exported your Bitwarden / 1Password / KeePass vault
You want to check 500+ passwords before a security audit
You just heard about a new major breach and want to verify impact
You’re helping a family member or client secure their accounts

How to Use the Tool

Go to the Bulk Password Breach Checker
Paste passwords (one per line) or upload a CSV export
Click Check for Breaches
Review results with breach counts
Change any compromised passwords using our Strong Password Generator

Frequently Asked Questions

Is it really safe to upload my vault export?

Yes. The file is processed entirely in your browser using the File API. Nothing is sent to our servers.

Does Utilora log or store any data?

No. We have no backend for this tool. Once you close the tab, the data is wiped from memory.

How accurate is it?

It uses the official Have I Been Pwned dataset — the same trusted source used by companies worldwide.

What should I do if passwords are pwned?

Immediately change them to strong, unique passwords. Enable 2FA wherever possible.

Ready to audit your vault?

→ Open Bulk Password Breach Checker

SQL Explorer: Run Full SQL on CSV, Parquet & JSONL Files in Your Browser

Pure Life Tribe — Wed, 10 Jun 2026 04:04:31 +0000

Query large local files with industry-grade SQL — without uploading anything.

Utilora SQL Explorer brings the power of DuckDB directly into your browser using WebAssembly. This means you get a full analytical database engine running locally — no servers, no data leaving your device, and no installation required.

Why This Tool Exists

Data professionals waste a lot of time importing files into Excel, Python, or cloud databases just for quick exploration. SQL Explorer eliminates that friction.

Key Features

Full DuckDB SQL support (Joins, Window functions, CTEs, aggregations, etc.)
Native support for CSV, Parquet, JSONL, and JSON
Multiple file joins in one session
Fast even on large files (100MB+)
Export query results as CSV
100% client-side & private

Real-World Use Cases

Data Analysts — Quickly explore exported reports from Stripe, Shopify, or GA4
Engineers — Validate data quality before pushing to warehouses
Students & Learners — Practice SQL on real-world datasets
Product Managers — Analyze CSVs from internal tools without asking engineering
Freelancers — Work with client data while maintaining privacy

How to Use SQL Explorer

Go to SQL Explorer
Drag and drop one or more CSV, Parquet, or JSONL files
Wait for the files to load (usually very fast)
Write your SQL in the editor (auto-complete available)
Run the query and explore results in the table below
Export results if needed

Comparison

Feature	Utilora SQL Explorer	Excel / Google Sheets	Python + Pandas	Online SQL Tools
No Data Upload	Yes	Yes	Yes (local)	No
Full SQL Support	Excellent	Limited	Excellent	Good
Parquet Support	Yes	No	Yes	Rare
Zero Installation	Yes	Yes	No	Yes
Privacy Level	100% Local	Local	Local	Low
Speed on Large Files	Very Fast	Slow	Fast	Varies

Frequently Asked Questions

Q: How large can the files be?

A: Performance is excellent up to several hundred MBs. Very large files (1GB+) may be slow but still workable.

Q: Is my data safe?

A: Yes. Everything runs in your browser. No data is sent to any server.

A Privacy-First Video Captioner That Runs in Your Browser

Pure Life Tribe — Fri, 29 May 2026 05:15:16 +0000

I’ve been looking for a simple way to add captions to short videos without uploading them anywhere. Most tools require you to send your file to a server, which isn’t ideal for privacy or speed.Recently
Video Captioner by Utilora Link

It’s a web tool that runs completely in your browser using Whisper AI. You select a video (or audio file), it transcribes and adds captions — nothing ever leaves your device.

What I like about it:

No sign-up required
Works offline after the model loads
Clean presets: TikTok-style, Classic, Minimal, Karaoke
You can edit the transcription directly
Built-in audiogram generator for podcast clips
Exports as WebM with embedded captions

The first time you use it, it downloads a ~74MB model. After that, everything is fast and local.I’ve been using it for Reels and short clips. It’s quick, looks good, and gives me full control without relying on third-party services.

If you create short-form content and care about privacy (or just hate uploading videos everywhere), give it a try. It’s one of the cleaner tools I’ve used in this space lately.Would love to hear if others have tried it or found similar browser-based tools.

Build a Private AI Search on Your Device: Local RAG in the Browser

Pure Life Tribe — Wed, 27 May 2026 05:33:50 +0000

How many times have you wanted to search your private PDFs, notes, or code files using AI, but hesitated?

We all want the power of AI search. But uploading sensitive documents to external servers is a big privacy risk.

What if you could build a complete search engine that runs 100% inside your browser? No servers, no APIs, and no cost.

At Utilora, we built exactly this. We call it Personal RAG. Here is how we made it work, and how you can do it too.

The Architecture: How to Run RAG on a Web Page

Retrieval-Augmented Generation (RAG) usually requires a backend database, python servers, and API keys. To make it run entirely on the client side, we

combined three modern browser technologies:

Origin Private File System (OPFS): A fast, private storage space in the browser to save indexed document vectors.
Web Workers & Comlink: To run CPU-heavy vector searches without freezing the user interface.
Local Machine Learning Models: Using ONNX Runtime Web and Transformers.js to generate embeddings directly on your CPU or GPU.

Here is the exact flow of how a document is processed:

[ Your File ] ➔ [ Client Parser ] ➔ [ Chunking ] ➔ [ Local ML Embedding ] ➔ [ OPFS Storage ]

Step 1: Storing Vectors Privately (OPFS)

You cannot store millions of text numbers in normal browser storage like LocalStorage. It is too slow and has a 5MB limit.

Instead, we use the Origin Private File System (OPFS). It gives web
apps a private, highly optimized filesystem. Here is a simple look at how we write vector indexes to OPFS:

// Access the private root directory                                                                                                                     
const root = await navigator.storage.getDirectory();                                                                                                     

// Create or access our index file                                                                                                                       
const fileHandle = await root.getFileHandle("vector-index.db", { create: true });                                                                        

// Create a high-speed write stream                                                                                                                      
const accessHandle = await fileHandle.createWritable();                                                                                                  
await accessHandle.write(new TextEncoder().encode(JSON.stringify(myVectorData)));                                                                        
await accessHandle.close();

Step 2: Offloading Work to a Web Worker

We use Comlink by Google to easily communicate with a background Web Worker:

// In your main component
import * as Comlink from "comlink";

const worker = new Worker(
    new URL("./rag-indexer.worker.ts", import.meta.url),
    { type: "module" }
);
const localIndexer = Comlink.wrap(worker);

// Run indexer in the background
await localIndexer.processAndEmbedFile(myUploadedFile);

Why Local RAG is a Game Changer

Building with zero backend constraints completely changes how you think about software:

• True Privacy: Privacy is not a text policy on a page. It is hardcoded into the architecture. Since there is no backend, we cannot see your files even if
we wanted to.
• Completely Free: You do not pay for API keys, vector databases, or server hosting. The user's computer does all the work.
• Instant Offline Access: Once the page loads, you can turn off your internet and it still works.

Try It Yourself

If you want to see this in action, come check it out on Utilora https://utilora.com (our free, open collection of local web utilities).

Drag in a PDF, let it index, and ask questions. Your data never leaves your screen.

Have you built anything using local browser models? Let's chat in the comments below!

The Case for Local-First Tools in the Age of Cloud AI

Pure Life Tribe — Wed, 20 May 2026 06:33:47 +0000

A few months ago, I realized how weirdly dependent my daily workflow had become on external APIs. Need to remove an image background? Upload it to a remote database. Need to OCR a PDF? Send it to a third-party service.

Outsourced processing works, but I don’t love constantly tossing my data onto random servers just to use a basic tool.

So, I ran an experiment to see how far we can push local-first, browser-based AI. I built Utilora — a playground hosting utilities like offline OCR, background removers, and private document search. The rule was strict: Zero server uploads. Everything runs purely inside the browser.

Here is an honest look at how it works and where the boundaries are.

How to Stretch the Browser Stack
Running ML inference inside a standard tab used to freeze the UI. Today, three technologies make it highly performant:

WebAssembly (WASM): Runs compiled C++ or Rust model code at near-native speeds in the browser.

ONNX Runtime Web: Executes production-grade models directly on the client side.

WebGPU / WebGL: Grants the browser direct access to local hardware acceleration.

By using optimized, quantized models (like U²-Net or smaller transformer embeddings), I shrunk the footprint down to 10MB–50MB—small enough to cache locally, but powerful enough for 95% of everyday tasks.

The Honest Trade-offs
Pushing browser capabilities this far comes with clear constraints:

The First Load: The initial visit requires downloading the model weights. I had to lean heavily on Service Workers and IndexedDB so every subsequent visit loads instantly.

Borrowing Compute: You are at the mercy of the user's hardware. A high-end laptop breezes through inference, while an older phone might struggle.

Model Size: You aren't running a 70B parameter LLM in a browser tab. This architecture forces you to use specialized, hyper-focused models. It’s perfect for audio transcription or image processing, but it won't replace massive centralized LLMs.

The Realization
Building this project proved that we don't always need to spin up serverless functions or backend APIs. A massive chunk of everyday workflow automation can live entirely in the client. It’s a great feeling when privacy is a structural guarantee verified by the network tab, rather than a legal promise in a privacy policy.

If you’re curious about the mechanics under the hood, I wrote a deeper architectural breakdown on my blog: The Case for Local-First Tools in the Age of Client-Side AI.

Are you experimenting with client-side ML or WASM tools? What kind of hurdles are you hitting?

The Privacy-First Web: Why Digital Tools Should Respect Your Data

Pure Life Tribe — Wed, 13 May 2026 07:11:28 +0000

In today’s internet, you are the product. Your clicks, documents, searches, and communications are constantly harvested, analyzed, and monetized. But it doesn’t have to be this way.

I just published a detailed guide on why privacy should be the default — not an optional feature — and how to choose tools that actually respect your data.

Key points covered:

The privacy paradox behind “free” tools
What sensitive data (financial, health, communications, intellectual exploration) truly needs protection
Technical markers of real privacy: end-to-end encryption, local processing, no-log policies, data minimization, and open source
Practical questions you should ask before trusting any tool
Common privacy pitfalls in everyday apps and services
How to start building your own privacy-first toolkit

Privacy isn’t about paranoia — it’s about digital autonomy and making conscious choices.

Read the full article here:

👉 The Privacy-First Web: Why Digital Tools Should Respect Your Data

Would love to hear your thoughts — what privacy-first tools are you currently using?

I Built a PII Redactor That Runs 100% in Your Browser

Pure Life Tribe — Sun, 10 May 2026 07:26:06 +0000

Because sending logs with customer data should never feel like playing Russian roulette.

You know that exact moment. You’re staring at a production log, a support ticket, or a messy JSON response. It has everything you need to debug the issue… and a bunch of stuff you definitely shouldn’t share.

An email address here. A phone number there. Maybe even a credit card test number someone left in by mistake.

You could spend 20 minutes doing find-and-replace. Or you could just cross your fingers and hope for the best.

Or, you could paste the whole thing into a tool that redacts everything sensitive in one click, locally, with zero data leaving your machine.

That’s exactly what I built.

It’s called the PII Redactor on Utilora.

How It Actually Works

The core idea is stupidly simple: a bunch of regex patterns run one after another on your text. Every match gets replaced with a placeholder (you can choose what it shows - [REDACTED], [EMAIL], etc.).

What I like is the feedback it gives you. After redaction, it tells you exactly what it found: “3 emails, 2 IPv4 addresses, 1 phone number.” That little summary has saved me more than once when I thought I was safe but actually missed something.

Built-in Filters (The Ones You’ll Use Most)

Out of the box it catches the usual suspects:

Email addresses
IPv4 and IPv6 addresses
US Social Security Numbers (with dashes)
Credit card numbers (13–16 digits)
Phone numbers (fairly flexible format)

These patterns aren’t perfect (more on that later), but they cover 80-90% of everyday cases.

Custom Patterns = Where It Gets Powerful

This is my favorite part.

Every team has their own internal sensitive formats — order IDs, API key patterns, internal hostnames, employee IDs, etc. You can add your own regex with a label, and it gets treated exactly like the built-ins.

I’ve used it for things like:

ORD-[A-Z0-9]{8} style order numbers
Specific UUID prefixes used internally
Secret patterns that follow a company convention

It Also Handles Files

Drag in a .log, .txt, .json, or .jsonl file and it works the same way. Super handy when someone dumps a giant log in your DMs.

Why Browser-Only Matters

I deliberately made this (and every tool on Utilora) run completely locally. No uploads, no accounts, no tracking.

When you’re dealing with real customer data or production logs, the last thing you want is to send it to yet another third-party service — even a “trusted” one.

This way it’s instant, works offline, and I can use it on planes, in cafes, or behind strict corporate networks without thinking twice.

Honest Limitations

The IPv6 detection is pretty basic right now - it only catches the long form. Compressed IPv6 addresses still slip through.

The credit card detector is deliberately loose. It’ll catch obvious card numbers but can also flag random long numbers. Good enough for most quick redaction jobs, but not production-grade secret scanning.

If you need something more bulletproof for serious compliance work, this isn’t a replacement for dedicated tools — but for day-to-day debugging and sharing, it’s been fantastic.

Try It Yourself

→ PII Redactor on Utilora

It’s completely free, no sign-up, and nothing ever leaves your browser.

If you work with logs, support tickets, or any kind of data that might contain PII, bookmark it. You’ll probably use it more often than you expect.