AI Liber — Artificial intelligence for everyone

English · Română · Français · Italiano · Español · Português · Deutsch · Magyar

Version: 2.2.1 · Last updated: 2026-10-31

Interface languages: Română, English, Français, Italiano, Español, Português (PT), Deutsch, Magyar

Status: stable (2.2.0). The optional password encryption of API keys is new and has not been audited by a third party.

Offline: partial. The interface and the bundled libraries load offline after the first visit (service worker); every chat answer needs a network connection to the chosen provider, except local Ollama / LM Studio servers and the WebLLM model once downloaded.

Chat with free artificial-intelligence models or with your own API keys, plus a guide to the best free AIs, in a single HTML file.

Live app: https://chiuta.github.io/AI-Liber/

What it is

AI Liber is a single-file app (index.html) that offers one chat interface to several language-model providers: free services with no account (for example Pollinations, DuckDuckGo AI Chat, AI Horde), services with your own API key (OpenAI, Anthropic, Gemini, Groq, Mistral, OpenRouter, Perplexity), local servers (Ollama, LM Studio) and a model run directly in the browser through WebLLM. It also includes a section with a catalogue of free AIs, a quiz and prompt ideas.

Features

• Chat with a model/provider selector, sending with the "➤ Send" button, stopping a request in progress.
• A Markdown formatting bar (bold, italic, strikethrough, code, list, quote, table, etc.).
• A "Configure API keys" panel for the providers that require a key; the keys are kept locally, obscured with AES-GCM (the app explicitly warns that this is not strong encryption).
• A "Check & update models" button to refresh the model list.
• Support for local Ollama servers (localhost:11434) and LM Studio (localhost:1234) and for a local in-browser model (WebLLM).
• A "Best free AIs" catalogue, filterable by category (Chat, Research, Images, AI Video, Media, Code, Writing, Productivity, Creative) and by "No account" / "Local (browser)".
• A bottom panel with "⚡ Quick ideas" (prompts), "🧠 AI Quiz" and "⌨️ Shortcuts".
• Interface in 8 languages: Romanian, English, French, German, Spanish, Portuguese, Italian, Hungarian.
• Privacy texts (GDPR), terms and information about cookies/local storage, in every language.

Privacy features (since 1.1.0)

• Local check for personal data before sending (FFF.pii): when the message is about to go to an external service (Pollinations, DuckDuckGo, AI Horde, API-key services), the app looks locally for emails, phone numbers, IBANs (mod 97), CNPs (check digit), cards (Luhn), IPs, keys/tokens. If it finds something, it sends nothing until you choose: "Mask the ticked items and continue", "Continue without masking" or "Cancel" (the text stays in the field). It can be switched off from the sidebar (the preference is kept). For local models (WebLLM, Ollama, LM Studio) the dialog is not shown, because the text does not leave the computer.
• "What leaves this device" indicator next to the model selector: "Local: messages stay in the browser" (WebLLM), "Local: messages go only to the server on this computer" (Ollama/LM Studio) or "Messages go to " (external services). For WebLLM, the indicator specifies that the model files are downloaded from the network on first use, but your text does not leave.
• Optional local conversation history (off by default): if you tick "Save conversations on this device", conversations are kept in localStorage (keys ai-liber.conv, ai-liber.hist), with personal data masked if you want (button "Search for personal data in the history"). The "🗂 Local history" panel has local search by meaning (FFF.search: BM25, diacritics, close forms, highlighted fragments), resuming a conversation in the chat, deletion per conversation, Markdown export.
• Encrypted copy of the history through the transparency label (Export encrypted, password). The API keys and the session secret are not included in the copy (verified in a test).

Limits

• Personal-data detection is heuristic (proper names and addresses have low confidence). It does not guarantee the absence of sensitive data.
• Masking applies to the text in the message field, not to files already uploaded to the chat.
• The history has a size cap; when it is exceeded, the oldest conversations are removed (with a message).

FFF kit. From fff-kit (pasted into index.html, no network) the modules core, label, bundle, pii, search are used: the transparency label (press the version in the footer), .fff.json export/import/deletion with optional AES-GCM + PBKDF2 encryption, local personal-data detection and local BM25 search. The CSP policy has not been changed from the previous version apart from the sha256 hashes of the inline scripts (the new styles are in <style>, covered by the style-src 'unsafe-inline' already present; no new host was added). The translations of the new texts into fr/it/es/pt/hu/de are automatic and not natively verified. Personal-data detection is heuristic: it may miss or wrongly flag; it does not replace your own checking.

User guide

1. Open the app and choose the language from the language selector (Romanian, English, Français, Deutsch, Español, Português, Italiano, Magyar).
2. Choose a model from the list. Models marked "No account" do not require a key.
3. For a provider with a key: press "⚙️ Configure API keys", enter the key for the provider you want and close the window.
4. Write the message in the text field and press Enter or "➤ Send". Shift+Enter inserts a new line.
5. Formatting: Ctrl+B (bold), Ctrl+I (italic), Ctrl+Z (undo); Esc closes the windows; ↑↓ navigate the model list.
6. For local models: start Ollama with OLLAMA_ORIGINS=* ollama serve or the LM Studio server on port 1234, then choose the local model.
7. Use "⚡ Quick ideas", "🧠 AI Quiz" or the "Best free AIs" section for inspiration and for discovering services.
8. To delete the data, use the options described in the privacy window or clear the site's data in the browser.

Privacy and network

The app is not strictly offline: the chat works only by contacting the services you choose.

• API-key persistence: the keys are encrypted (AES-GCM) with a random secret kept in sessionStorage; in practice they survive a reload of the same tab, but not a new tab or a browser restart (the secret is lost, the encrypted keys remain unreadable in localStorage), so they have to be re-entered. Verified by a test (reload: the key stays; new tab: empty).
• Local storage (localStorage): the language (ai-liber.lang), obscured API keys (ai-liber.aik.enc_*, ai-liber.aik.*) with a salt (ai-liber.ksalt), a local list of models that returned a 404 error (ai-liber.404), an interface preference (ai-liber.sbw), the option to automatically update the model list (ai-liber.pollauto, only if you tick it). In sessionStorage: a session secret (ailib_ssec). Also: the personal-data check preference (ai-liber.piiguard) and, only if you tick the option, the local history (ai-liber.hist, ai-liber.conv).
• On page load: no automatic request is sent to Pollinations. The live model list (https://text.pollinations.ai/models) is requested only if you press "Reload Pollinations models" / "Check & update models" or explicitly tick, in the sidebar, "Automatically update the list at startup" (opt-in, off by default; the preference is kept in ai-liber.pollauto). Until then the local catalogue in the page is used. When an answer contains formulas ($…$), KaTeX is loaded from vendor/ (same origin, with SRI integrity check).
• Third-party hosts contacted, only after an action of yours (sending a message, reloading the list, enabling WebLLM): text.pollinations.ai, auth.pollinations.ai (Pollinations); duckduckgo.com (DuckDuckGo AI Chat); aihorde.net (AI Horde); api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, api.perplexity.ai and other providers' APIs, only if you use the respective key; raw.githubusercontent.com/mlc-ai/binary-mlc-llm-libs/00fe7a40e57e5e8eb9fef87526a4bf28ad5846c0/ (the model library .wasm, pinned commit, verified by WebLLM with SHA-256 SRI; only when you enable the in-browser model) and huggingface.co/mlc-ai/ (+ *.huggingface.co, *.hf.co) for the weights, which have no pinned hash. WebLLM itself (@mlc-ai/[email protected]) is in , not on a CDN.

Password encryption for API keys (since 2.1.0, optional)

In the "⚙️ API keys" window there is a "Password protection" card. Off by default: keys keep working exactly as before (obscured with AES-GCM, secret in sessionStorage).

• When you turn it on, the paid-provider keys currently available in the session are encrypted with AES-256-GCM, with a key derived from your password through PBKDF2-SHA256, 600,000 iterations and a random 16-byte salt, and stored as one envelope in ai-liber.aik.vault. The old entries are deleted only after the envelope has been read back and decrypted successfully (migration without loss). "Turn off protection" does the reverse after you confirm the password.
• The app asks for the password when it opens (you can dismiss the dialog; the keys then stay unavailable) and the keys are then kept in memory only. "Lock now" drops them from memory.
• Honest limits: the component is small and has not been audited by a third party; the password cannot be recovered (if you forget it, enter the keys again); it does not protect against a malicious script or browser extension running in the page while the keys are unlocked; a short password can be guessed offline. The interface text of the card exists in Romanian and English (other languages fall back to English).
• Tests: node tests/keyvault-core.test.mjs (WebCrypto in Node: round trip, wrong password, tampering, iterations) and node tests/keyvault-ui.test.mjs (headless browser: turn on, reload, unlock, add a key, turn off).
• Languages: the card and dialogs are available in all 8 interface languages (RO and EN written by hand; FR/IT/ES/PT/DE/HU are machine translations, not verified by native speakers). Test: node tests/keyvault-i18n.test.mjs.

AI Liber vs. Nexus fără frontiere

Both are single-file chat front-ends and they overlap in the "chat with your own API key" part; they are kept separate on purpose.

	AI Liber	Nexus fără frontiere
Aim	A gateway for everyone: free no-account models, a guide to free AIs, quiz, prompt ideas	A working tool for people who already have keys: agents, step flows, own agents
No-account / free services	Yes (Pollinations, DuckDuckGo, AI Horde)	No: a key (or a local endpoint) is required
In-browser model (WebLLM) and local Ollama / LM Studio	Yes	Local endpoints only via "Custom"
Agents and agent flows	No	Yes
Providers	OpenAI, Anthropic, Gemini, Groq, Mistral, OpenRouter, Perplexity and more	Anthropic, OpenAI, Google and "Custom" (OpenAI-compatible)

See also: https://chiuta.github.io/Nexus-fara-frontiere/

Limitations

AI answers can be wrong; the app displays under the message field the warning "AI can make mistakes. For medical/legal/financial info — consult a specialist" (in the interface language). Messages are processed by the chosen providers, according to their policies.

Running locally / offline

Download index.html and open it in a browser. The interface, the catalogue, the quiz and the guides work without internet; for any chat answer you need a connection to the chosen provider (or a local Ollama/LM Studio server running on your computer).

Licence

MIT — see the LICENSE file

Audit

Audit: 2026-10-10 (round 2: 2026-10-11) — fetchPollModels() is now opt-in (it no longer runs at startup or on visibilitychange without your consent); the message in the interface about keys explicitly says they last only for the tab's session; KaTeX from cdn.jsdelivr.net (index.html:~7063). The Markdown rendering of AI answers is protected against XSS (tested with <img onerror>, javascript:, injected attributes in href, formulas). Contrast and focus fixes.

Author

Alexio — Alexandru-Ionuț Chiuță, contact: [email protected]. The app is offered in the spirit of the trade-free TROM movement (trom.tf); voluntary support is optional.

Summary

AI Liber is a single-file HTML chat front-end for free no-account AI services, bring-your-own-key APIs, local Ollama/LM Studio servers and an in-browser WebLLM model, plus a directory of free AI tools, a quiz and prompt ideas. 8 UI languages. Keys are kept in localStorage (AES-GCM obfuscated, not strong encryption). Chat requires internet access to the chosen provider. MIT licence.

Sources verified on 11.10.2026

• DuckDuckGo AI Chat (duck.ai), free models with no account: TechRadar, "Duck.ai by DuckDuckGo review", 13 July 2026 (https://techradar.com/pro/duck-ai-review): Claude 4.5 Haiku, GPT-4o mini, GPT-5 mini, gpt-oss-120b, Llama 4 Scout, Mistral Small 3 24B. The models hard-coded in the app for DuckDuckGo (Claude 3 Haiku, Llama 3.1 70B, Mixtral 8x7B, o3-mini) may be retired; DuckDuckGo's API IDs cannot be verified without a network and were not changed (the app has "Check & update models" and the list of models that return 404).
• Pollinations (text, no key, ~1 request/15 s anonymous, optional free key): https://free-llm.com/provider/pollinations-ai (page updated in October 2026).
• The legal texts (version "v1.0 · 12 April 2026") were not modified in this round; their date is the author's decision and was not changed.

History / Changelog

2.0.0 — 2026-10-26

• New Model lab (🧪 in the sidebar and the top bar): send the same question to several models one after another and compare time to first token, total time, characters/s and (Chrome only) JS-heap change measured on this device; per-model privacy profile (stays in the browser / only your local server / which external host), local registry with per-model medians and your preferred answers, JSON/CSV export. The same consent for keyless external services and the same personal-data check as in chat apply. Not measured: GPU/RAM memory of the model (browsers do not expose it).

1.4.9 — 2026-10-23

• Storage keys now carry the app prefix (ai-liber.*); existing data (language, history, encrypted API keys, salt) is migrated automatically at startup, and old .fff.json copies can still be imported.
• fff-kit 1.2.0: unprefixed-storage fixed
• Quick prompts: the missing "Productivity" category was added in French, German, Spanish, Portuguese and Italian (language parity).

1.4.7 — 2026-10-22

• Library loading no longer trusts a CDN: WebLLM 0.2.84 (and KaTeX 0.16.9) are in vendor/ and loaded from the same origin; model libraries (.wasm) come from a pinned binary-mlc-llm-libs commit and are verified by SHA-256 SRI (refused on mismatch). The CSP no longer allows esm.run, cdn.jsdelivr.net or the whole of raw.githubusercontent.com.

• The Gemma 2 model ids now match WebLLM 0.2.84 (gemma-2-*-it-q4f16_1-MLC). New NOTICE.md. Added size: ~6.4 MB.

• 1.4.6 — 2026-10-22: fff-kit 1.1.4: touch targets and minimum text size

• 1.4.5 — 2026-10-22: fff-kit 1.1.2: PBKDF2 600,000 iterations, anti-clickjacking protection

• 1.4.4 — 2026-10-22: Consent dialog before the first message to an external keyless service (Pollinations, DuckDuckGo, AI Horde); the model-removal confirmation uses an in-page dialog instead of window.confirm; text ≥ 12 px and larger checkboxes on mobile.

• 1.4.3 — 2026-10-22: fix: the AI Horde and local-model names (LM Studio, Ollama) and the AI Horde card in the explore grid now follow the selected language.

• 1.4.2 (22 October 2026): The page title now follows the interface language; the model list labels and the Explore catalog are rebuilt in the saved language at startup (they used to stay Romanian after a reload); the model-check dialog text is translated.

• 1.4.1 — 2026-10-19: the personal-data check before sending, the "what leaves" indicator and the optional local history described above (introduced in 1.1.0) are present in the current version: they had been removed by mistake in an earlier cleanup and were reimplemented with the same behaviour and new tests (tests/fff-r8.test.mjs). The interface (including the descriptions of the models) is available in 8 languages, Hungarian included.

• 1.1.0 — 2026-10-14: local check for personal data before sending (FFF.pii), "what leaves" indicator, optional searchable local history (FFF.search), encrypted .fff.json copy (FFF.bundle), transparency label; tests in tests/fff-r8.test.mjs.

• 1.0.0 — 2026-10-12: the version and the date of the last update are shown in the app

• 11 October 2026 (round 7) — in the API-keys panel the security note no longer displays the literal <strong>NOT</strong> (the HTML tags were removed from the text in the 7 languages); the "🤖 AI Models" header in the side panel and the "N models (cache/live)" badges are now translated when the language changes; the models' specification labels ("Fastest", "Reasoning", "Programming", etc.) are translated into EN/FR/IT/ES/PT/DE; the providers' guides in Settings appear in English (not in Romanian) in the non-RO languages; the CSP keeps the recalculated hash. The legal texts were not modified. 0 errors, axe 0 violations at 1280×800 and 360×740.