The Toolbox is open: 25 tools, nothing uploaded

The Toolbox is open — twenty-five utilities, free, no account, no install. The thing worth saying first is the thing that shaped every line of it: the tool surface makes zero network requests. Not "we delete your files after an hour", not "processed securely" — there is nothing to delete, because the bytes never move. We grepped the whole surface to be sure before we wrote that on the hub.

Twenty-five tools, four categories

• Files — gzip compress/decompress, a ZIP archiver and extractor, an image converter, and a four-digest file hasher.
• Text — JSON formatter, Base64, URL encoder, a real Myers text diff with word-level highlighting and unified patch output, an acronym-aware case converter, a segmenter-correct word counter, seeded lorem ipsum, and an RFC 4180 CSV↔JSON converter.
• Code — regex tester with a runaway guard, JWT decoder with local HS256 verification, timestamp converter, UUID/v7/nanoid generator, a cron parser that answers in plain words, SHA and HMAC hashing, a password generator, and a strict XSS-safe markdown preview.
• Design — color converter across HEX/RGB/HSL/OKLCH with WCAG contrast, gradient and box-shadow builders, a QR generator, and a palette extractor that reads an image you never upload.

Search across all of them is diacritic-folded, so typing bäse finds Base64, and it is wired to the keys your hands already know: / focuses the field anywhere on the hub, ⌘K works from anywhere on the page, Enter opens the top hit. Three tools carry a quick action that generates and copies a value — a password, a UUID, a paragraph of filler — straight from the hub card, without opening the tool at all.

What it took to stay local

Client-side tools with no upload are easy to promise and expensive to keep. Eight of the twenty-five run their work in a dedicated Web Worker so a 900 MB archive never touches the thread that draws your cursor. Compression, extraction and hashing are streamed rather than buffered: the ZIP writer flushes Blob parts every 16 MiB so the heap stays flat regardless of input size, and past 4 GiB it stops trying to be clever, keeps the CRC, and stores the original file with zero copies. The file hasher computes all four digests in one pass under 256 MiB and switches to a hand-written incremental SHA-256 above it.

Some of it is just craft for its own sake. The QR generator is our own encoder — ISO/IEC 18004 model 2, Reed–Solomon over GF(256), all eight mask patterns scored — because every library we looked at wanted more of the page than a QR code is worth. The palette extractor runs median cut with one deliberate deviation from the textbook: it splits at the widest gap between occupied bins rather than at the median index, which is the difference between reading a logo as white and black and reading it as white and slightly less white.

The hub itself is twenty-five little CSS-3D dioramas — no WebGL, one scene per category, seeded from the tool's own slug so no two cards are posed alike and their animation timings drift ±15% so the grid never breathes in sync. If you have reduced motion turned on, each scene freezes at its composed resting pose, which looks like a decision rather than a broken animation.

Tremor went up yesterday and does the opposite of this — it pulls the whole planet's seismicity down over the wire (how it works). The Toolbox is the quieter half of the same instinct: build the thing properly, then give it away.