The engine lives in your tab.
yourbrowsercandoit.com is a static web page that loads a small set of WebAssembly libraries on first use, then runs every operation against the file you drop in. Your file’s bytes never go into a network request, and the browser itself is told to block any attempt to send them.
The libraries
- pdf-lib
- Merges, splits, signs, watermarks, and writes new PDFs. Pure JavaScript.
- pdf.js
- Renders PDF pages to canvas for preview, OCR, and raster operations.
- ffmpeg.wasm
- Audio and video transcoding, trimming, compression, GIF generation. About 25 MB on first load, then cached on your device. Uses the multi-threaded build where the browser allows it and the single-threaded one elsewhere (Safari and iOS).
- tesseract.js
- OCR with 13 language models. Each language is fetched on first use, then cached.
- libheif (via heic-to)
- Decodes Apple HEIC/HEIF photos to standard formats. Safari decodes natively; other browsers use the WASM build.
- JSZip
- Builds and reads
.ziparchives. - html2canvas
- Renders HTML to image, used for HTML → PDF.
- QRCode
- Generates QR codes from text.
- @imgly/background-removal
- Background removal with a small neural network via ONNX Runtime Web. The code is served from this site; the model (about 50 MB) downloads from IMG.LY’s CDN on first run.
- Web Crypto API
- SHA-256, AES-GCM, PBKDF2. Native to the browser.
- Canvas, File, MediaDevices
- Native browser APIs for image transforms, file handling, and camera capture.
What runs on the network, and what doesn’t
Everything you do to a file runs locally. The page talks to exactly these servers, and nothing else:
cdn.jsdelivr.net: library JavaScript and WASM, each pinned to an exact version.staticimgly.com: the background-removal model, only when you use Remove background.cloud.umami.is/gateway.umami.is: a cookieless usage counter. It receives the page, the tool name, the output file type, a size range (like “1–10 MB”), and standard browser details (referrer, device type, language). Never file names, contents, or anything you type.- This site itself, for the page and its code.
That list isn’t just a promise. It’s the site’s Content-Security-Policy, a header the browser enforces: a request to any other destination is blocked before it leaves your device. Every tool page also has a “network activity” panel that lists each request as it happens.
A service worker keeps the app and every library you’ve used on your device, so tools you’ve run once keep working with no connection at all. You can install the site as an app from your browser’s menu.
What this means for you
- No upload buttons. The file you drop on a tool stays in this tab’s memory until you close it.
- No accounts. Nothing to sign up for, nothing to log into, nothing tracking you across visits.
- No upgrade tier. Every tool works in full from the first click.
- Verifiable. Open the network activity panel on any tool, or DevTools → Network. Run the tool. Your file’s bytes never appear in a request.