OpenTools

Everyday browser tools. Your files never leave your device.

getopentools.com · Report a bug · Security · Sponsor

---

OpenTools is a free, open-source collection of PDF, image, audio, video, subtitle, developer, data, text, math, and QR utilities that run entirely inside your browser. No account, no upload, no watermark, no ads, no third-party tracking. The server keeps one visit log per page view — see What the server logs.

The Zero-Egress Privacy Promise

Most online converters upload your tax returns, invoices, photos, and source code to someone else's server. OpenTools does the opposite: every computation happens in-memory on your device.

Layer	How it stays local
Input	Files are read as in-memory File / ArrayBuffer objects. Nothing is written to a server or to persistent storage.
Compute	PDF merge/extract runs pdf-lib in a dedicated Web Worker. Image work uses Canvas and OffscreenCanvas. Background removal runs WebAssembly model inference in a Web Worker. Audio and video edits copy compressed samples at the container level — no codec, no re-encode. Hashing uses WebCrypto.
Output	Results are handed back as temporary blob: URLs and revoked on clear, cancel, or unmount.
Enforcement	Production responses ship Content-Security-Policy: connect-src 'none', and the test suite rejects direct network primitives in local engine code.
Visit log	No third-party analytics, session replay, advertising or payment SDK is loaded in the browser. The server logs one metadata event per page visit, and the page may request one of nine fixed content-free counter images, never your files or inputs — see What the server logs.

Model downloads. AI tools fetch their model weights once before first use. These are app assets, like JavaScript or fonts — they never contain your data. Background removal loads U²-Net (lite) and the ONNX Runtime WebAssembly binary from this site only (/models/, /ort/).

You don't have to trust us: open DevTools → Network, go offline, and run a tool. See SECURITY.md.

What the server logs

When a page (not a static asset) is requested, the edge handler in proxy.ts writes one tool_impression event to Cloudflare Workers Logs. It records:

• Country, from Cloudflare's cf-ipcountry header. Coarse country level only: region and city are not logged.
• The page path, and the tool query parameter if present.
• Device type (mobile, tablet, or desktop), derived from the user agent. The user agent itself is not stored.
• Primary browser language, truncated to 10 characters.
• The referring site's category (for example Google, GitHub, Reddit). The raw referrer URL is not stored.
• A timestamp.

Cloudflare's own error reports. Separately from the event above, Cloudflare sends every site it serves a NEL / Report-To header, so a browser that fails to reach the site may report that failure (the URL, the error type and timing) to a.nel.cloudflare.com. success_fraction is 0.0, so successful requests are never reported, and no file, input or result is ever included. This is added at Cloudflare's edge, not by this app, so it cannot be removed in proxy.ts or public/_headers; it is switched off per zone in the Cloudflare dashboard, or with the zone nel setting in Cloudflare's API.

This event does not include your IP address, city, region, raw referrer, cookies, files, file names, pasted text, or results — tools run in the browser, so the server never receives them. Logs are retained under Cloudflare's Workers Logs retention. Cloudflare may also record standard request metadata for its platform logs.

Say What You Need Done

There is one text box on the home page. You type the job in your own words — "make this under 2MB and strip my name out of it" — and it answers with the tools that do it, in order, or tells you this site cannot. Where the steps are operations the batch runner can take, it offers to run the whole chain over your files in one pass.

It reads the sentence on your device, and that is structural rather than promised: these pages ship connect-src 'none', so the tab cannot open a connection, and the test suite fails on a network primitive anywhere in lib/command/. There is no model and no API key, which is also why it can say what it cannot do — a language translation, an email, today's exchange rate — instead of answering with whichever tool shares a word with the question. A gap that is just a missing tool offers to file itself as an issue, with your words already in the form and nothing sent until you submit it.

See docs/COMMAND_BAR.md for how it reads a sentence, why the index is 35 KB, and what it still cannot do.

Core Tool Suite

691 live tool routes, 679 of them browsable from the 17 sidebar groups. Those counts come from generated data, and navigation.test.ts fails the build when they drift. Every tool shows a completion receipt with measured duration, output facts, and an explicit privacy boundary.

Suite	Tools	Routes
📄 Document & PDF	Merge, extract pages, rotate/reorder/delete/number/watermark/metadata, images → PDF, compress, PDF → Word, fill & sign, document generators (README, changelog, invoice, receipt)	/pdf/merge, /pdf/extract-pages, /pdf/page-tools, /pdf/images-to-pdf, /pdf/compress, /pdf/to-word, /pdf/sign, /documents/workbench
🖼️ Image	Background removal (WebAssembly model inference), optimizer (resize/compress/convert), editor	/image/background-remover, /image/optimize, /image/editor
🎵 Audio & Video	MP3 cut/join/tag/inspect, M4A · FLAC · OGG · AIFF → WAV, video trim/mute/extract audio without re-encoding	/audio/mp3-toolkit, /audio/convert, /video/trim
💬 Subtitles	SRT / VTT / SBV / LRC conversion, shift, two-point resync	/subtitles/workbench
⚡ Developer	JSON formatter, Base64 encoder/decoder, UNIX timestamp, UUID generator, file hash (SHA-256/384/512), SQL formatter, minifier and ER diagram	/developer/*, /data/json, /file/hash-calculator
📊 Data & Spreadsheets	CSV ↔ JSON transformer, delimiter conversion, CSV → SQL	/data/csv-to-json, /data/workbench
🗄️ Files & Archives	Open and make ZIP files, split and join, checksum verify, duplicate finder, signature inspector	/file/archive, /file/workbench
🔤 Text & Writing	Word count, case converter, regex find & replace, Markdown ↔ HTML, diff and merge	/text/case-converter, /text/workbench, /text/writing
🧮 Math, Science & Finance	Unit converter, percentage calculator, formula calculators (results only, never advice), business and finance math	/math/percentage-calculator, , ,

The route list is not hand-maintained prose: LIVE_TOOL_ROUTES in lib/seo/live-tools.ts is the single source of truth, and a route only counts as live when the code that renders it really runs the operation.

Run It Yourself

The whole site ships as a container, so you can run it on your own machine or inside your own network:

docker compose up -d      # then open http://localhost:8796

That pulls a published multi-arch image — linux/amd64 and linux/arm64, so a Raspberry Pi works — and needs no Cloudflare account, no build toolchain and no network access at runtime. You can check that last claim rather than take it:

docker run --rm -d --network none --name opentools ghcr.io/mgbuilderos/opentools:latest
docker exec opentools node -e "fetch('http://127.0.0.1:8796/').then(r=>console.log(r.status))"

Worth knowing before you compare it to anything else you self-host: this server does no work and never receives a file. Other file tools you can host accept an upload, convert it on the server, and hand the result back. This one serves a page and stops — the conversion happens in the browser that opened it. So your hardware only serves static pages however many people use it, and handing the URL to someone else never makes you the custodian of their documents.

The image ships no TLS and no authentication, which is why the compose file binds to loopback. To go beyond that, put a reverse proxy in front and turn on the optional access gate. /self-host is the page for an administrator deciding; docs/SELF_HOSTING.md has the measured no-network results and what self-hosting deliberately does not include; docs/APP_CATALOGUES.md covers installing it from a home-server app store.

Sponsorship & Patronage

OpenTools is free forever. There are no paid tiers and no result is ever gated. The project is sustained entirely by voluntary support from people who find it useful. UPI charges no platform fee, so the whole contribution arrives; Buy Me a Coffee takes a platform cut of each transaction, which is part of why UPI is offered first to supporters in India.

Channel	For	Methods
🌍 Buy Me a Coffee	International supporters	Credit/debit card, Apple Pay, Google Pay, PayPal
🇮🇳 UPI	Supporters in India	Any UPI app via QR code or upi://pay deep link on mobile

The /support page picks the right channel automatically. Detection (isLikelyIndiaVisitor() in lib/support-config.ts) runs locally using your browser's timezone and language settings — no IP lookup or geolocation request is made. You can always switch channels manually.

The support page is fully isolated from tools: it never receives file names, job data, or results.

Local Development & Quality Control

Prerequisites

• Node.js >= 22.13.0
• npm 11.12.1 (the SBOM gate compares against the version that generated the checked-in SBOM; other npm majors emit different output)

Commands

npm install        # install dependencies
npm run dev        # start the local development server
npm run qc         # full quality-control suite (must pass before a PR)
npm run build      # production build (Cloudflare Workers output in dist/)

npm run qc runs the fail-fast gates in order:

1. Format — oxfmt --check
2. Unit + all-operation I/O — 1,100+ Vitest tests, including local-source zero-egress policy checks. npm run qc prints the exact count for your tree
3. Type check — tsc --noEmit
4. Lint — OxLint with warnings denied
5. Design system contract — semantic Tailwind tokens only
6. Build — production Vinext build
7. SBOM inventory — checked-in CycloneDX SBOM must match the lockfile
8. Blueprint integrity — runs only inside the private blueprint workspace

npm run qc:release additionally runs npm audit --audit-level=high.

Tech stack

Vinext (Next.js API on Vite) · React 19 · Tailwind CSS v4 · Base UI · pdf-lib · ONNX Runtime Web · Web Workers · Cloudflare Workers.

Project layout

app/          routes (one folder per tool)
components/   shared workbench UI and tool components
lib/tools/    pure tool logic, manifests (catalog.ts), and tests
lib/command/  the home page's command bar: reads a request, plans the steps
workers/      Web Workers for heavy processing
scripts/      QC, design-system, and SBOM scripts
release/      checked-in SBOM

Contributing

Contributions are welcome. Read CONTRIBUTING.md and the owner decision log first. In short:

• Tools must never make network requests with user data, and must never add third-party analytics or tracking. The only server-side log is the documented visit log, and the only client-side signals are the nine fixed, content-free counters in decisions/ADR-020-product-signals.md; changes to either must update the docs in the same PR.
• Dependencies must be MIT-compatible and recorded in THIRD_PARTY_NOTICES.md.
• Use semantic design tokens (bg-success, text-foreground, border-border).
• npm run qc must pass.

Security Policy

Unexpected network egress, tracking, or telemetry beyond the documented visit log is treated as a critical vulnerability. Report it privately via GitHub's private vulnerability reporting — not a public issue. Full policy: .github/SECURITY.md.

License

MIT © 2026 OpenTools Contributors. Third-party components retain their own licenses — see THIRD_PARTY_NOTICES.md.