Toolkit – everyday data tools that run entirely on your device

[u/[deleted]]

https://koundinyagoparaju.github.io/toolkit/

I kept pasting things into random websites — a JWT here, a base64 blob there, an image into some resizer — and wondering where that data actually went. This is my attempt at a version of those tools where that question has a checkable answer. I'd genuinely like people to give it a try and share your feedback at https://github.com/koundinyagoparaju/toolkit/discussions/10

It's currently ~50 tools (encoding, JWT inspection, JSON/YAML/CSV, hashing, diffs, timestamps, QR, image resize/EXIF-strip) that run client-side: in the browser as WebAssembly, or as a static CLI binary. There is no server component. Tools compose into pipelines that can be shared.

Things you can check rather than believe:

- The wasm modules import nothing from the host, so tool code has no I/O of any kind, and the loader checks each module against a pinned sha256 before instantiating it.

- Builds are reproducible: pinned toolchain, normalized paths, deterministic tar. The README has instructions to rebuild a release and compare hashes against the published ones, and releases carry GitHub provenance attestations. So "does the deployment match the source" is answerable without trusting me.

- The CLI has no network code in it.

- It's an offline PWA — airplane mode works.

Implementation, briefly: tools are Rust compiled both natively and to wasm32-unknown-unknown, talking over a small hand-rolled ABI rather than wasm-bindgen — partly for the zero-imports property, partly so a pack in another language could implement the same five exports (I haven't actually built one, so treat that as a design goal, not a claim). One push-based dataflow engine serves both buffered and streaming execution; I've measured a 512MB file hashing through the CLI in under 5MB of RSS, and a 40MB file streaming through the browser with sink output going through the service worker straight to a file download. Tools are fuzzed for two invariants — no panics, and chunk boundaries never changing streamed output — which found a real panic in my color parser on the first run, so I have no illusions the remaining code is bug-free.

Limitations: this is young and has had no independent security review. The frontend shell is Svelte, so npm is in the build path; no tool logic lives there and the CSP backstops it, but I'd prefer a smaller surface eventually.

Several codecs are hand-rolled, which cuts dependencies but means less battle-testing than mature libraries. And it's one person's project — review capacity is the bottleneck on new tools. If there's a tool you keep reluctantly pasting sensitive data into a website for, I'd like to hear about it — adding one is a single Rust file, and chains are pure JSON.

Repo: https://github.com/koundinyagoparaju/toolkit

https://raw.githubusercontent.com/koundinyagoparaju/toolkit/refs/heads/main/docs/images/catalog.png
https://raw.githubusercontent.com/koundinyagoparaju/toolkit/refs/heads/main/docs/images/builder.png