Collection16 tools
Privacy-first tools
Metadata, credentials, redaction and signatures — handled in the tab instead of on someone else's server.
There is a category of small task that is genuinely awkward to do online. Stripping the GPS coordinates out of a photo before you post it. Blurring a face or an account number in a screenshot. Checking what a JSON Web Token actually contains. Reading the text out of a signed contract. Each of these takes about ten seconds with the right utility, and the ordinary way to get that utility is to paste your file into a search result and hope.
The problem is not that those sites are malicious. It is that the transaction is invisible. You cannot tell whether the file is deleted after processing, whether it is retained for a training set, whether it sits in an object store with a guessable URL, or whether the operator has any idea either. For a holiday snap, nobody cares. For a passport scan, an employment contract, a medical letter or a screenshot with a customer's details in it, the calculus is different — and it is different in a way that is hard to explain to a compliance team after the fact.
Every tool in this collection avoids the question by never sending the file anywhere. The processing runs as JavaScript and WebAssembly inside your tab, on your CPU. Closing the tab is the deletion step.
What 'runs in the browser' actually means here
It is worth spelling out, because the phrase is used loosely across the web. When you pick a file with one of these tools, the browser hands the page a reference to it. The page reads the bytes into memory, does the work — canvas operations, WebAssembly, the Web Crypto API — and writes a new file back out as a download. At no point does the file travel over the network, because there is no upload code to travel through. You can verify this yourself: open your browser's network panel, use any tool on this page, and watch for a request carrying your data. There is not one.
Two honest footnotes. First, loading the page is a network request — the site is served from a CDN like any other, and there is no service worker, so a tool has to be fetched before it can run offline of anything. Once the page is open, the processing is local, but the page itself is not something you can load without connectivity. Second, this site runs privacy-preserving page-view analytics (Vercel Analytics). It records that a page was viewed. It does not, and structurally cannot, see the contents of a file you never uploaded.
One tool in the site's wider catalogue does need the network by design — the currency converter, which fetches exchange rates — and it is marked as such on its own page. Nothing in this collection is in that category.
Metadata: the part of a photo you did not mean to share
A photo from a phone carries an EXIF block: camera model, lens, exposure, the exact timestamp, and very often latitude and longitude to several decimal places. Social platforms usually strip it. Email attachments, cloud drive links, forum uploads and file-sharing services frequently do not.
EXIF Viewer is the diagnostic — it parses the metadata block and shows you what is in there, grouped into file, camera, settings, date and GPS. Look at a few of your own photos with it once; it is the sort of thing that changes how you handle images afterwards. EXIF Remover is the fix. It works by redrawing the image pixels onto a fresh canvas and re-encoding, which drops every metadata segment as a side effect of how canvas export works. Worth knowing: that means a JPEG comes out re-encoded rather than byte-identical minus the metadata, so there is a small generational quality cost, and a source in an unusual format comes out as JPEG or PNG.
Photo Censor handles the pixels rather than the metadata. Draw a rectangle over a face, an address bar, a card number, and apply a blur, a pixelation or a solid block. Because the result is flattened onto a canvas and re-exported, the covered pixels are genuinely destroyed rather than hidden behind an overlay — which is the failure mode that has embarrassed people who used a drawing app's opaque shape and shipped the layered file.
Text, credentials and documents
PII Detector & Redactor is the text equivalent. It combines a named-entity model running locally in your browser, which catches people, organisations and places, with pattern matching for the things a model is bad at and a regular expression is good at: email addresses, card numbers, IP addresses and phone numbers. It is a strong first pass over a support transcript or a log file before you share it, and — as with any automated redaction — it is a first pass, not a guarantee. Read the output.
The credential tools are the ones where uploading would be self-defeating in the most literal sense. Password Generator and Password Strength produce and assess secrets; a password that has been transmitted to a website to be evaluated is no longer a password. Hash Generator computes digests locally via the browser's own crypto primitives. Text Encryption encrypts a note with a passphrase you hold. TOTP Generator derives two-factor codes from a shared secret — a secret whose entire security model is that it stays on devices you control. JWT Decoder splits a token into its header and claims so you can see what a bearer token is asserting, without pasting a live session credential into an unknown host.
For documents: Extract Text from PDF pulls the text layer out of a contract locally, and Image to Text runs OCR in WebAssembly when the document is a scan with no text layer. Sign PDF and Signature Maker let you draw a signature and place it on a page. QR Code Scanner decodes from your camera or an image file without a round trip. And Notepad is the small one people end up using most: a scratchpad that saves to your own browser, for the paragraph you did not want to leave in a chat window.
Sixteen tools, and when the privacy part matters
Each of these exists elsewhere as an upload-and-wait web service. The reason to use this version is in the second half of each line.
- EXIF RemoverImage ToolsBefore posting or emailing a photo — strips the GPS coordinates and camera metadata without the photo leaving your machine.Open tool
- EXIF ViewerImage ToolsTo see what an image is actually carrying before you decide whether to strip it. Read-only, nothing transmitted.Open tool
- Photo CensorImage ToolsBlur or block out a face, an address or a card number in a screenshot; the covered pixels are destroyed in the export.Open tool
- PII Detector & RedactorAI ToolsSanitise a support transcript or log before sharing it. The entity model runs in your tab, so the unredacted text stays there.Open tool
- Text EncryptionSecurity ToolsEncrypt a note with a passphrase. A tool that encrypts your text on a server has not encrypted it from the server.Open tool
- Password GeneratorSecurity ToolsGenerate a password. Anything generated server-side has been over the wire before you ever saw it.Open tool
- Password StrengthSecurity ToolsTest a password you are considering, without submitting a real password to a stranger's form.Open tool
- Hash GeneratorSecurity ToolsCompute a checksum or digest locally, including for content you would not want to paste into a hashing site.Open tool
- TOTP GeneratorSecurity ToolsDerive a 2FA code from a shared secret that should never be sent anywhere by design.Open tool
- JWT DecoderSecurity ToolsInspect a token's header and claims — usually a live session credential, which is exactly what you should not paste online.Open tool
- Sign PDFFile ToolsPlace a drawn signature on a contract without uploading the contract to sign it.Open tool
- Signature MakerProductivity ToolsDraw a signature once and export it as a transparent image you keep.Open tool
- Extract Text from PDFFile ToolsPull the text out of an agreement or statement locally, when the document is the confidential part.Open tool
- Image to Text (OCR)Text & Language ToolsOCR a scanned page or a photo of a document; the WebAssembly engine is self-hosted here rather than a vision API.Open tool
- QR Code ScannerData ToolsDecode a QR code from your camera or a screenshot without sending the image to a decoding service.Open tool
- NotepadText & Language ToolsSomewhere to put text that autosaves to your own browser instead of a synced document you forget about.Open tool
The honest boundaries of this claim
Local processing is not the same as offline. There is no service worker on this site, so a tool has to be loaded over the network before it can run. Once it is loaded, the work is local — but if you are on a plane with a cached tab, that is the browser's doing, not a feature we built.
Local processing is not the same as zero telemetry. The site records page views through Vercel Analytics. That tells us a page was opened. It does not carry file contents, because file contents are never sent anywhere for it to carry.
Local processing is not a substitute for a threat model. If your device is compromised, a tool running on your device is compromised with it. If you download a redacted file and then email the original by mistake, the redaction did its job and you did not. And automated redaction — including the PII tool here — has recall below 100%, which is a polite way of saying it will miss things. Check the output before you share it.
Finally: this is a website, and you are being asked to take the claim on trust. The strongest thing we can say is that it is checkable. The source is open, and the network panel in your browser will settle the question in ten seconds for any tool on this page.
Related collections
- PDF toolsMerge, split, rotate, stamp and extract — with a straight account of what compression and Word conversion really cost.
- Image toolsEighteen canvas utilities for the four things people actually do to images: make them smaller, change the format, change the shape, make them presentable.
- On-device AI toolsWhisper, translation, OCR, segmentation and neural speech, executed on your own CPU or GPU — with the download sizes stated up front.