I built an in-browser passport & visa photo maker with zero server uploads (Looking for feedback!)

Hey everyone! 👋

I got frustrated seeing passport photo websites charge $15+ or upload private biometric portraits to third-party servers.

So I built FotoPassport (https://www.fotopassport.com):

• 100% client-side privacy using HTML5 Canvas (zero photos sent to any server).
• Pre-configured government specifications for US (DS-160 & DV Lottery), Schengen, UK, Canada, France, Germany, etc.
• Automatic JPEG compression to strict embassy file size limits (≤ 240 KB).
• Printable 4x6" sheet generator for 35¢ kiosk printing at local stores.
• 100% free and no signup required.

Check it out: https://www.fotopassport.com

Would love to hear your thoughts and feedback!

Comments

[Amit Feldman]

Zero server uploads for passport photos is a genuinely strong design call — most tools in this space quietly phone the image home.

Quick public check of fotopassport.com (headers + public config only):

1. HSTS is already solid (max-age=63072000) — nice. But 5 of the 6 standard security headers are unset: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. For a product whose whole pitch is "your photo never leaves the browser," CSP + frame-ancestors are the pair I'd ship first.
2. Minor SEO wrinkle: robots.txt and sitemap.xml return 308 through the apex→www redirect instead of 200 — crawlers mostly follow it, but serving them directly on the final host removes the ambiguity.

TLS 1.3, canonical tag and title/meta are all clean, and TTFB is a snappy 77ms after redirect. Happy to re-run the scan free after the headers land — good luck with the launch!