Fifteen tools that
never phone home.
Strip the GPS from vacation photos. Shrink a scan to hit a 2 MB portal limit. Sign a lease at 11pm. OCR a month of receipts. Reorganize a PDF. Diff two contract drafts. Make — or decode — a QR code without a sketchy generator site. Every tool runs inside this browser tab — your files are processed by your own device and never sent anywhere. Free & open source (MIT).
Suite automation for humans — and for machines
Every tool is scriptable. Drive them from an AI agent with a Model Context Protocol endpoint, or with plain parameterized URLs — the same pages, the same privacy: files stay on the device running the browser.
MCP endpoint
JSON-RPC 2.0 at POST /tools/mcp — initialize, tools/list, tools/call. Compute tools: catalog, QR payloads, text diff, text stats. Stateless, no auth, protocol 2025-06-18.
Deep links with parameters
Every page accepts a strict allow-list of URL params — qr.html?text=… renders instantly, shrink.html?url=…&targetKB=300 pre-loads and pre-sets. ?url= is same-origin only, enforced in code.
Machine-readable docs
llms.txt + llms-full.txt at the site root, tools.json as data, and a full reference page — so an agent can discover and drive the whole suite without a human.
{"jsonrpc":"2.0","id":1,"method":"tools/list"} → POST /tools/mcp
The toolbox
Nothing matches — try a different word.
Prefer a standalone repo? Every tool also has its own GitHub home — one repo per tool, each linking back here.
Real examples, real numbers — from the actual verification runs
Every claim below is asserted by an automated browser test on every push. These aren't marketing numbers; they're test results.
You: posting beach photos, unaware your phone wrote the hotel's coordinates into every JPEG.
GPS leak flagged red → stripped → output JPEG has no EXIF segment at all, byte-identical picture.
You: "Attachment exceeds maximum file size." The portal wants 2 MB; your scan is 16.
Lands under your exact target — and the downloaded file is checked against the limit by the test suite.
You: "Sign and send back tonight." No printer. No DocuSign subscription. 11pm.
The signature is flattened into the page — no editable field, just ink. The test asserts it's inside the PDF's resources.
You: twelve crumpled receipts, one expense spreadsheet, zero motivation.
Totals land in editable rows — fix anything OCR misread, export expenses.csv for Excel or Sheets.
You: a 3-page contract photographed crooked on a gray desk.
Crop, straighten, grayscale, stack → one clean PDF. The crop drag is regression-tested to land exactly where you drew it.
You: a guest asks for the Wi-Fi. Generator sites would log that password.
Round-trip proven: encode → export → decode returns the exact payload, character for character — tested in CI and on production.
Same tools you'd pay for — without the catch
The tools you know, minus the uploads, accounts, watermarks, and monthly fees. And unlike them, this suite is verified — every release runs a 92+ check gate that drops real files in and validates the downloaded bytes.
| Tool | Runs on | Network after load | Output verified by |
|---|---|---|---|
| 🛡️ Photo Privacy Kit | Byte-level EXIF parser | nothing | APP1-segment absence in output JPEG |
| 🔍 Metadata Checker | EXIF + PDF + OOXML readers | nothing | Cleaned files re-inspected |
| 🗜️ Image Shrinker | Canvas + binary search | nothing | 294 KB ≤ 300 KB target |
| 📄 Scan Cleaner | Canvas + pdf-lib | nothing | Page count + crop size in output |
| ✍️ E-Sign Pad | pdf-lib (+ pdf.js preview) | nothing | Signature image in PDF resources |
| 🧾 Receipts → PDF | EXIF + pdf-lib | nothing | 3 stamped pages, correct order |
| 🔢 Receipt OCR → CSV | Tesseract (self-hosted WASM) | nothing* | Line items parsed in CSV |
| 🔳 QR Studio | qrcode-generator + jsQR | nothing | Generate → decode round-trip matches |
| 📑 PDF Pages | pdf.js render + pdf-lib rebuild | nothing | Page order & rotations in rebuilt PDF |
| 🔬 Text Diff | LCS engine (unit-tested) | nothing | Word-level spans asserted |
| 📊 Text Stats | Stats engine (unit-tested) | nothing | Counts & keywords asserted |
| 🎧 Audio Trimmer | Web Audio + lamejs | nothing | WAV data-chunk = exact selection |
| 🧮 Invoice Generator | Canvas + pdf-lib | nothing | $408.00 total in exported PDF |
| 🗂️ Batch Rename | EXIF + JSZip | nothing | Renamed entries inside ZIP |
| 🖨️ Print-Shop Prep | Canvas + pdf-lib | nothing | MediaBox = 306 pt (4.25 in) |
* OCR downloads the Tesseract engine and English model from this same site on first use — after that it's cached and fully offline. No third party ever sees your images.
Questions people actually ask
If there's no server… where does the processing happen?
In your browser tab, on your device. Each tool is a static page with JavaScript that reads your file into memory, processes it with Web APIs (Canvas, Web Audio, WASM), and offers the result as a download. Close the tab and it's gone.
Can you see my files? Is there a log?
No, and no. There is no upload endpoint, no queue, no storage bucket — nothing that could receive a file. The security suite proves this on every release: it loads every page, watches every network request, and asserts that nothing goes anywhere but this site.
What's the catch? Is there a premium tier?
No catch, no tier, no watermark, no "upgrade to unlock bigger files." MIT licensed — take the code and self-host it if you like. The only limit is your device's memory.
Does it work offline?
Yes — after your first visit, the service worker precaches every page and engine (including the 24 MB OCR model). A test literally turns the network off and runs a tool to prove it.
Who made this?
NavigatorsLab — a lab for local-first, private-by-default software. The suite's big sibling is PDF Studio, a full in-browser PDF editor.
Privacy isn't a promise here. It's the architecture.
These are static pages. There is no server that could receive your files — no upload endpoint, no queue, no storage bucket, no analytics, no cookies, no accounts. We keep no attachments and no user information, ever. Open devtools → Network, load any tool, and watch it stay silent after the initial load.
CSP: default-src 'none' · script-src 'self' · connect-src 'self' · no third-party origins, ever