I've been quietly building Antigravity Tools — a collection of 59 free, browser-based developer utilities — and today I'm sharing everything I built and learned.
Why vanilla JS? No React, no build step.
The main constraint I set for myself: zero dependencies, zero server, zero telemetry.
When you paste your JWT token into jwt.io, it goes to their server. When you use an online regex tester, your test strings are logged. I built Antigravity Tools so every operation runs inside your browser, using native APIs.
No Node.js backend
No npm packages
No webpack/vite/parcel
No Google Analytics
No cookies
Everything runs on Web Crypto API, Canvas API, Web Audio API, and IndexedDB — all native to modern browsers.
The 8 tool categories
🔐 Security & Auth Tools
- JWT Inspector — decode JWT header, payload, and check expiry locally
- RSA & ECC Key Generator — generate 2048-bit key pairs via SubtleCrypto
- Hash & Password Generator — SHA-256/SHA-512 via Web Crypto
- PII Masker — strip emails, credit cards, SSNs, IPs from text
- Universal Encoder/Decoder — Base64, URL, Hex, HTML entities, Unicode
🤖 AI & Prompting Tools
- AI Token Counter — estimate cost across GPT-4o, Claude 3.5, Gemini 2.0, DeepSeek R1
- System Prompt Builder — structure agent instructions with XML tags and tool definitions
- AI Text Humanizer — rephrase robotic AI output into natural writing
- Prompt Cost Trimmer — compress prompts by 30–50% to reduce API costs
⚡ Dev & Code Tools
- JSON Workbench — beautify, validate, convert to TypeScript, Python, Go types
- cURL Converter — cURL → JS fetch, Python requests, Go, PHP
- Regex Tester — real-time match highlighting with capture group display
- Cron Builder — visual cron expression editor with plain-English output
- Git Command Helper — build undo/squash/cherry-pick commands visually
Top comments (1)
Hello Yuva, I am Kane Lim from Hong Kong. I have over 10 years of development experience. I am writing this because your post was interesting.
The strongest part of Antigravity Tools is not the number of utilities, but the architectural decision to keep sensitive workloads entirely client side. Using Web Crypto API, IndexedDB, Canvas and Web Audio without introducing a dependency chain significantly reduces the attack surface, supply chain risk and operational complexity.
For the next level, I would consider treating every tool as an isolated capability with a shared security boundary. A capability based architecture could enforce strict input isolation, CSP, Trusted Types and zero network access for security sensitive modules. Service Workers could provide offline caching while Web Workers handle expensive parsing, cryptographic operations and large payload transformations without blocking the main thread.
For the AI utilities, model specific tokenization should be separated from the estimation layer, with versioned pricing metadata and deterministic test vectors. I would also add property based testing and fuzzing for parsers such as JWT, JSON, regex and encoders. This would make the platform considerably more resilient against malformed or adversarial input.
59 tools built under these constraints is impressive engineering discipline. I would be very interested in discussing the architecture and potential scalability improvements with you.
I would like to get to know you better and discuss about your post. Would you please contact me? t_g_@kanelim1997