I built PXEL: A 100% Client-Side Privacy-First Image & PDF Toolkit (Wasm)

Hey dev community! 👋

I was tired of uploading sensitive PDF documents and images to random online converters. To solve this, I built PXEL (https://www.px-el.site).

What makes it special?

• 🔒 Zero Server Uploads: 100% of the files are processed locally inside your browser using WebAssembly.
• ⚡ Features: Compress, Resize, Crop, Convert Images (PNG, JPG, WebP), Merge PDFs, and OCR (Image-to-Text).

I'd love your honest feedback, critique, or feature suggestions!

Comments

[Amit Feldman]

A 100% client-side toolkit is the right call for image/PDF work — "your files never leave the browser" is a promise users are right to be skeptical of, and Wasm makes it structurally true instead of a marketing line.

Quick header scan of px-el.site: this is the cleanest config I've seen this week — HSTS preload, XFO, nosniff, Referrer-Policy, and a Permissions-Policy that locks camera/mic/geolocation. One gap: no Content-Security-Policy. It matters more for you than most, because CSP is the header that technically enforces the privacy pitch — default-src 'self' means even an injected script (compromised dependency, XSS) can't phone your pixels home. Right now nothing blocks that.

On Vercel it's one headers block in vercel.json. One Wasm nuance: add script-src 'self' 'wasm-unsafe-eval' — plain 'self' breaks WebAssembly compilation in most browsers.

Happy to re-scan once it's live.