DEV Community: tarunvashishth

I lay down. A 0.23B open model sorted my screenshots folder.

tarunvashishth — Tue, 20 Oct 2026 13:52:25 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady.

Somewhere on your laptop there's a folder that looks like this:

Screenshot 2026-10-03 at 13.04.11.png
Screenshot 2026-10-03 at 13.04.11 (2).jpg
Screenshot 2026-10-06 at 22.17.40.png
Screenshot 2026-10-09 at 10.02.55.png
IMG_4821.PNG
...

Every one of those was taken on purpose, to keep something. A receipt for a refund. The error message you meant to paste into an issue. The train ticket. Then they all got the same useless name, and now finding the receipt means opening forty files.

Sorting that folder is the purest kind of chore: low stakes, mildly gross, and always postponed. In honour of International Sloth Day, I built something that does it while I lie down.

What I Built

Screenshot Sloth reads every screenshot in a folder with an open-source vision model, inside your browser tab, and proposes a plan:

Rename each file for what's on it: Screenshot 2026-10-03 at 13.04.11.png becomes 2026-10-03-receipt-tandoor-express.png, and IMG_4821.PNG becomes 2026-10-11-ticket-shatabdi-express-12002.png.
File them into folders: Receipts, Chats, Errors, Code, Tickets, Maps, Documents, Photos.
Flag the ones holding a one-time code, card number, Aadhaar, PAN, UPI ID or password, and put them in one _Review (sensitive) folder so you can look once and delete.
Catch duplicates (that (2).jpg you saved twice) and set the extras aside.

You see the whole plan before anything moves. Fix any name, untick anything you want left alone, then apply. In Chrome and Edge it moves the files in place and logs every move, so Undo puts every file back where it was. Other browsers get a sorted .zip, and your originals stay put.

It's for anyone with a Desktop full of screenshots, which is everyone. It's especially for people whose screenshots are mostly UPI receipts, OTP messages and WhatsApp chats, which is a lot of us in India.

Demo

Try it: https://tarunvashishth.github.io/screenshot-sloth/

Click Try the demo desktop to run it on 12 synthetic screenshots drawn in the page: a food-delivery receipt, a build error, a chat, an OTP SMS, a train ticket, a test credit card, a map, a saved-twice duplicate and more. All of it is fake data, so you can watch the whole flow without pointing it at your own files.

The first run downloads the model once (about 350 MB, then cached). After that the demo goes like this:

Before	After
`Screenshot 2026-10-03 at 13.04.11.png`	`Receipts/2026-10-03-receipt-tandoor-express.png`
`Screenshot 2026-10-06 at 22.17.40.png`	`Errors/2026-10-06-error-build-failed.png`
`Screenshot_20261008-191502_WhatsApp.jpg`	`Chats/2026-10-08-chat-whatsapp-rohan.jpg`
`Screenshot 2026-10-09 at 10.02.55.png`	`_Review (sensitive)/…` flagged One-time code ••••••
`Screenshot 2026-10-12 at 09.12.31.png`	`_Review (sensitive)/…` flagged Card number •••• 1111
`Screenshot 2026-10-03 at 13.04.11 (2).jpg`	`_Duplicates/2026-10-03-receipt-tandoor-express.jpg`

Code

tarunvashishth / screenshot-sloth

Sorts your screenshots folder: an open-source vision model (Florence-2) reads each one in your browser, renames and files it, and flags OTPs and card numbers. Nothing is uploaded.

Screenshot Sloth 🦥

Your screenshots folder, sorted while you lie down.

Try it: https://tarunvashishth.github.io/screenshot-sloth/ (Chrome or Edge to sort in place; any browser for the demo)

Point it at a folder full of Screenshot 2026-10-03 at 14.22.01.png files. An open-source vision model reads every one in your browser tab, then proposes a plan:

Rename each file for what's on it: 2026-10-03-receipt-tandoor-express.png, 2026-10-06-error-build-failed.png
File them into folders: Receipts, Chats, Errors, Code, Tickets, Maps, Documents, Photos
Flag the ones holding one-time codes, card numbers, Aadhaar, PAN, UPI IDs or passwords, and put them together in _Review (sensitive) so you can look once and delete
Catch duplicates (the same screenshot saved twice) and set the extras aside in _Duplicates

You see the whole plan first, can fix any name or untick anything, then apply. Every move is logged to .screenshot-sloth-undo.json in the folder, and Undo puts every file back.

Nothing is…

View on GitHub

TypeScript and Vite, with no backend. The model runs in a Web Worker; rules.ts holds everything that decides names, folders and flags, and it has its own tests.

How I Built It

The model reads; plain code decides

Florence-2-base-ft is Microsoft's MIT-licensed vision model, small enough (0.23B parameters) to run in a browser through Transformers.js on WebGPU, with a WASM fallback. I used it for my Week 1 entry too, and it's very good at one thing I needed here: <OCR_WITH_REGION>, which returns every line of text with its bounding box.

The boxes turned out to be the most useful part. A screen's title is almost always its biggest text, so the name comes from the tallest line that isn't phone chrome: not the clock, not the battery, not a "Start navigation" button. Filenames carry the rest. macOS and Windows names hold the date, and Android ones hold the app (Screenshot_20261008-191502_WhatsApp.jpg).

I deliberately didn't ask the model to "categorise this screenshot". A 0.23B model's free-text guess is unpredictable, while OCR text plus small, testable rules is something I can debug. When a screenshot lands in the wrong folder, I can see why and write a test for it.

Tall screenshots get read in strips

Florence squashes every input to 768×768. A 1179×2556 phone screenshot squashed that far loses all its small text, so each screenshot is read as up to three square-ish strips from the top down, and the boxes are mapped back to full-image coordinates so the "tallest line" comparison still works across strips.

Sensitive data: a pattern isn't enough, so check the checksum

Screenshots are full of long numbers: order IDs, phone numbers, amounts. Flagging every 16-digit number would cry wolf, so each finding has to pass a real check:

Cards must pass the Luhn checksum.
Aadhaar numbers must pass the Verhoeff checksum, which UIDAI uses for the last digit.
PAN must match its actual structure (the fourth letter is the holder type).
OTPs only count when a 4–8 digit code sits next to words like "OTP" or "verification code".

Findings are always shown masked (•••• 1111), so the review screen doesn't become a second leak.

My favourite bug: the demo's OTP message wasn't flagged. The model had read "Your OTP for login is 482913." perfectly. My regex refused to match 482913 because a full stop followed it, and I'd written that check to skip decimals like 1299.50. The model was fine; my rule was the bug. That's the argument for keeping the model's job small: the mistakes end up in code you can test.

Duplicates: "looks alike" is useless for screenshots

My first version used a 64-bit perceptual hash (dHash), the textbook way to find near-duplicate images. On the demo it declared 8 of 12 screenshots copies of each other.

The reason is obvious in hindsight. dHash encodes whether each pixel is brighter than its neighbour. A screenshot is mostly a flat white page with a little text, and a sunset photo is a smooth vertical gradient. Both hash to roughly zero. To a perceptual hash, all screenshots look the same.

The fix was to require two signals: a duplicate has to look alike (mean pixel difference on a 32×32 thumbnail) and read alike (at least 80% overlap in the OCR'd words). A re-saved JPEG of the receipt passes both. A chat that happens to be equally white doesn't.

Moving files without losing any

The File System Access API lets a web page work inside a folder you pick. Screenshot Sloth uses FileSystemFileHandle.move() where the browser has it, and otherwise copies, checks the size, then removes the original. Every move goes into .screenshot-sloth-undo.json in the folder, which is written even if a run stops halfway. Undo replays it backwards, and only removes folders it created if they're empty. I tested both paths against the browser's origin-private file system (same API, no real files at risk), including name collisions and folders that already existed.

The Lazy Payoff

On the 12-screenshot demo desktop, on my Mac's GPU:

Machine time: between 1 min 21 s and 2 min 13 s to read all 12 across my runs (after the one-time model download)
My time: looking over the plan and clicking Apply
By hand: about 10 seconds a file to open it, read it, think of a name, type it and drag it, so 2 minutes for 12. A folder of a few hundred screenshots is an hour of that, which is exactly why nobody ever does it.

So it isn't faster than you, at about 7–11 seconds per screenshot. But a sloth doesn't need to be fast; it needs to be doing the work so you aren't. You start it, go make tea, and come back to a sorted folder.

Why Does Open Innovation Matter?

Because screenshots are the most private files you own, and the only way to sort them without handing them to someone else is a model you can run yourself.

Think about what's in that folder: OTPs, bank balances, card numbers, Aadhaar scans, boarding passes, private chats. You took them to keep something important, which is exactly why they're sensitive.

Other people have scratched this itch. One screenshot organizer sends each image to GPT-4V. It works, but every OTP and card number in the folder then goes to an API, and the cost grows with every screenshot. OrganizeShots runs in the browser and sorts by OCR into a zip. Screenshot Sloth builds on the same no-upload idea, adds content-based names, in-place moves with undo and checksum-verified flags, and is open all the way down: the code and the model doing the reading.

That openness matters for four concrete reasons:

Nothing leaves the tab. After the one-time download, the model works with Wi-Fi off. Your screenshots are never uploaded, because there's nowhere to upload them to.
You can check that. The model is MIT-licensed with published weights, and the app is MIT-licensed on GitHub. "Your files stay on your device" is something you can verify by reading the code or watching the network tab, not a promise you have to trust.
It costs nothing per screenshot. 12 or 1,200 cost the same, which makes it reasonable to just run it on everything.
It's forkable. Your screenshots aren't my screenshots. If yours are mostly Figma frames or Grafana dashboards, the categories are a small, readable rules file, and you can swap in a bigger Florence model or a different one entirely.

A closed API could probably name the odd screenshot more cleverly. But the job here isn't to be clever about one screenshot. It's to be trusted with all of them.

My Agent Session

I built Screenshot Sloth pairing with Claude Code. The first idea on our shortlist was an automatic subtitle syncer, until I remembered my own Cuelatch already does that, so we switched to this. The agent did most of the implementation and helped draft this post. The bugs in it are real ones from the build: the dHash false positives and the missed OTP both showed up on the first demo runs and were fixed with tests. The timings come from actual runs, and the move-and-undo code was tested against the browser's sandboxed file system before anything touched a real folder.

What's next

Searching by content ("that error with ECONNRESET") using the text it already read
Reading past the third strip of very long scrolling screenshots
A watch mode, so the folder stays sorted as new screenshots land

Touch grass. Then check what your photo gives away.

tarunvashishth — Wed, 07 Oct 2026 07:11:14 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

Pixel Leak checks an outdoor photo for clues to where you live before you post it. You drop in a photo, wait about ten seconds, and see what a stranger could learn from it. Then you blur those parts and download a clean copy.

Most people already know the GPS tag is a problem, and plenty of tools strip it. But metadata isn't the only leak. The street sign behind your kid, the number on your gate and the plate on the car in your driveway are all readable by anyone who zooms in, and stripping EXIF does nothing about them.

Pixel Leak checks both:

The metadata: GPS coordinates, capture time, device.
The pixels: street and locality names, house numbers, PIN/ZIP/postcodes, phone numbers, number plates, people and screens.

Who it's for: anyone who posts the outdoor part of their life. That includes runners whose route starts at the front door, parents posting the kids in the garden, people who share their morning walk, and anyone who has held back a nice photo because it showed a little too much.

How it fits Touch Grass: the theme asks for builds where the screen is the shortest part of the experience. Pixel Leak is a ten-second stop between the walk and the post. It doesn't keep you on a screen. It gets you back outside faster, with one less thing to worry about when you share.

Demo

Live: https://tarunvashishth.github.io/pixel-leak/

To try it without using your own photo, click Try a sample photo. The first visit downloads the model (about 350 MB), and your browser caches it after that. It runs fastest in Chrome or Edge with WebGPU, and falls back to CPU (slower) elsewhere.

Code

tarunvashishth / pixel-leak

Check a photo for location leaks before you post it — EXIF and the pixels. Open-source vision model (Florence-2) running entirely in your browser; nothing is uploaded.

Pixel Leak

Check a photo for location leaks before you post it. It covers the metadata and the pixels.

Stripping EXIF removes the GPS tag. It does nothing about the street sign, house number or number plate in the frame. Pixel Leak runs Florence-2 (MIT-licensed, ~230M params) entirely in your browser to read the photo the way a stranger would. It then lets you blur what it finds and download a clean copy.

Live: https://tarunvashishth.github.io/pixel-leak/

Nothing is uploaded. The only network request is the one-time model download from Hugging Face (~350 MB, cached by the browser). After that you can go offline and it still works.

What it checks

Source	Finds
EXIF (via `exifr`)	GPS coordinates, capture time, device
Florence-2 `<OCR_WITH_REGION>`	street / locality names, house numbers, PIN/ZIP/postcodes, phone numbers, emails, licence plates, other visible text
Florence-2 `<OD>`	people, licence plates, screens, signs, vehicles
Florence-2 `<MORE_DETAILED_CAPTION>`	a plain-language

…

View on GitHub

How I Built It

Everything runs in the browser tab. There's no backend at all, and the site is a static page on GitHub Pages.

Metadata. exifr reads GPS, capture time and device from the file.
Pixels. Florence-2-base (about 230M parameters, MIT license) runs in a Web Worker through Transformers.js. It does three passes over the photo:

| Florence-2 task | What I use it for |
| --- | --- |
| <OCR_WITH_REGION> | every piece of text, with a box around it |
| <OD> | people, vehicles, screens, signs |
| <MORE_DETAILED_CAPTION> | a plain-English "what a stranger sees" |

On WebGPU the vision encoder runs in fp16 and the text encoder and decoder in 4-bit. Without WebGPU it falls back to 8-bit on CPU.

Rules decide what counts as a leak. A small, unit-tested rules file turns the model's output into findings. It looks for street suffixes (Road, Marg, Sector, Nagar, Ave…), Indian PIN codes, US ZIPs, UK postcodes, Indian plate formats, phone numbers, emails and house numbers. Each finding gets a severity and a numbered box on the photo.
Clean copy. The photo is redrawn at full resolution on a <canvas> with your chosen areas blurred, then re-encoded. Only pixels survive. I checked the output for EXIF, XMP and GPS markers, and none were there.

A scan takes 8–11 seconds on my Mac with WebGPU.

Things I learned building it

Don't let the model be the judge. On my test photo, Florence-2's caption described a house number as "2218". The OCR pass on the same photo read it correctly as "221B". If I had built the leak detection on top of the caption, it would have been confidently wrong. So the model only reads, and plain rules decide what's sensitive. Every flag can be traced to a specific piece of text and a specific regex, and the rules run as tests in CI before every deploy.

Model boxes are approximate. In my tests Florence-2's boxes landed near the text, but were sometimes a little offset or too wide. So the blur covers a padded area around each box rather than the exact box, and I apply the canvas blur twice so large sign lettering doesn't stay readable through a light blur.

Re-encoding is a fair trade here. My other project, remove-exif.com, strips metadata byte by byte so the image data is never touched. Here that wasn't possible: once you blur pixels you have to re-encode them anyway. Doing it through a canvas also guarantees that no metadata block survives, because the canvas never had any.

"Works offline" is easy to say, so I tested it. I loaded the model, cut the browser's network, and ran a scan. It finished in 8.3 seconds and found every leak, with zero network requests during the scan.

What it can't do (yet)

It flags clues. It can't promise anonymity. Skylines, landmarks, shadows and reflections can still identify a place, and it doesn't reason about those.
The object detector is the weakest part. On my sample photo it caught every piece of text but didn't flag the (cartoon) car itself. Always look at the photo yourself before posting.
Small or angled text is hit and miss for OCR.
It doesn't open HEIC (the iPhone default). For now, export the photo as JPEG first.

Why Does Open Innovation Matter?

Because the honest version of this tool can't be built on a closed API.

A cloud vision API would mean uploading the photo you're worried about, the one with your street name in it, to a third party so it can tell you whether the photo reveals your street. That defeats the point.

An open-weight model changes that:

You don't have to take my word for it. The model downloads once, and after that nothing leaves the tab. Open DevTools, watch the Network panel and run a scan. Or turn off Wi-Fi.
It can stay free. There's no API key, no per-image cost and no account. The whole thing is a static site, so hosting costs nothing and there's nothing to shut down when credits run out.
It's easy to fork for your own country. The rules currently know Indian, US and UK address formats. Adding Brazilian CEPs or German plate formats is a regex in one file. And if a better small vision model comes out next month, swapping it is a change to one worker file.

My Agent Session

I built Pixel Leak pairing with Claude Code. I picked the idea from a shortlist built around my existing repos, and the agent did most of the implementation and helped draft this post. Every claim in it was checked against the running app before it went in: the scan times, the offline test, and the metadata check on the clean copy.