I built 154 PDF and video tools that run entirely in the browser: how, and how to check

Most free online PDF tools function in the same manner: users upload their files, a server processes them, and then they download the results. For sensitive documents like passport scans or bank statements, entrusting a stranger's computer with such tasks is a significant concern. To address this issue, I developed Stayput Tools, a collection of 154 free PDF, image, audio and video tools that process data directly within a user's browser tab.

During this process, no files are uploaded. This article discusses how Stayput Tools operates, its associated costs, and how you can verify that the tools are not merely deceiving. Uploading files is not necessary because modern browsers possess the capability to perform numerous tasks independently: PDF-lib facilitates PDF creation and editing, pdf.js is utilized for display, OCR is executed through a WebAssembly build of an OCR engine, video processing is carried out using WebCodecs (through Mediabunny library), and background removal is achieved using a small neural network running via ONNX Runtime (WebAssembly).

The website is static and devoid of any server capable of receiving files. This approach entails certain limitations: video processing is restricted to approximately 1 GB per file (8 GB with Compress Video and Trim Video), long videos on mobile devices take roughly as long to process as they play, and HEVC video requires a browser that can decode it.

To verify that no files are being uploaded, users can open their browser's developer tools (F12) and navigate to the Network tab. After utilizing any tool on the website, examining the requests will reveal that none of them contain the user's file. Alternatively, disconnecting from the internet and repeating the process will yield the same result.

Each tool page also displays the number of bytes sent, which can be verified by navigating to the specific page and copying the exact wording. Additionally, the website employs a Content-Security-Policy that limits connections to only its own domain, ensuring that even a bug cannot transmit files to external locations. Personal lessons learned: Without a frame rate, the encoder assumed 30 fps, resulting in a video with twice the bitrate when processed at 60 fps.

Adjusting the frame rate subsequently rectified this issue (from 2.7 Mbps requested, 5.6 Mbps before, and 2.9 Mbps after). Try out Stayput Tools and report any issues encountered. The website is a recent creation, thus any discovered bugs are of particular interest.