Skip to content
AB
All projects

Project

Live, with users

DailyToolNest

Free, no-account PDF, image, data and date tools (19 of them). Sensitive mode runs entirely in the browser with WebAssembly on an isolated origin, and you can verify that nothing is uploaded. Normal mode uses an encrypted, sandboxed server that deletes files within 15 minutes.

  • Next.js
  • Vite
  • WebAssembly
  • qpdf
  • libheif
  • jSquash
  • Content Security Policy
  • gVisor
  • AES-256-GCM
  • Caddy
  • Self-hosted (Germany, GDPR)
View PRDVisit live siteDiscuss this work

Purpose

DailyToolNest is a free, no-account suite of everyday file utilities built so that the private option is the easy option, and so that its privacy claim can be verified rather than taken on trust.

From the product site

Highlights

  • 19 free tools across PDF, image, data and date; no account
  • Sensitive mode: WebAssembly in the browser, on an isolated origin whose Content Security Policy blocks outbound connections
  • Anyone can check in the browser's own network panel that nothing is uploaded
  • Normal mode: TLS 1.3, AES-256-GCM at rest and gVisor-sandboxed containers; files deleted within 15 minutes
  • No ads, no dark patterns, no third-party analytics

Two modes

  • Sensitive mode: the file is processed entirely in the browser with WebAssembly in Web Workers, on device.dailytoolnest.com, a separate origin the browser itself stops from sending data anywhere
  • Normal mode: for files too large for the device, an encrypted, sandboxed server processes the file and deletes it when the page closes, five minutes after the download, or after fifteen minutes, whichever comes first
  • The mode is chosen before the file, and the tool never uploads without the user choosing to

Tools by category

  • PDF (8): Compress, Merge, Split, Rotate, Organize, PDF to JPG, Flatten, JPG to PDF
  • Image (3): Image Compressor (JPEG, PNG, WebP, AVIF), Image Resizer, HEIC to JPG
  • Data (2): CSV to JSON, JSON to CSV
  • Date (4): Days Between Dates, Age Calculator, Business Days Calculator, Add or Subtract Days

Two-origin security model

  • dailytoolnest.com: Next.js App Router behind Caddy, serving tool pages, guides, documentation and Normal-mode processing
  • device.dailytoolnest.com: a static Vite build with no server rendering, no API endpoints and no backend state
  • The device origin's CSP (default-src 'none', locked-down connect-src, frame-ancestors 'none', form-action 'none') means even the site's own code cannot send a file anywhere
  • Normal mode: TLS 1.3 in transit, AES-256-GCM at rest, gVisor containers with network egress disabled
  • Build hashes and an SBOM published at /.well-known/dtn-build.json

Capabilities

  • Safe device limit estimated from the device's memory and CPU count and shown before starting
  • Previews before and after, rendered in the browser from bytes it already has
  • Compress PDF is lossless by default and never returns a file larger than the input
  • A public guide to verifying Sensitive mode in the Network panel and the CSP header

Governance & quality

  • No third-party analytics or ad trackers; visits are counted with a hash whose secret is replaced every night
  • Self-hosted in Nuremberg, Germany, under GDPR
  • Documents are never inspected, sold or used to train AI models

Architecture & delivery

  • qpdf, libheif and jSquash compiled to WebAssembly for the browser; the same jobs run in sandboxed containers for Normal mode
  • Server limits: 40 MB per file, 120-second jobs, 100 MB output, up to 5 files per merge

Current stage & roadmap

  • Not built yet: OCR, true redaction (a flattened-redaction design exists), PDF/A conversion and larger data tools

Outcomes

  • Live at dailytoolnest.com with live users
  • 19 tools across 4 categories

Skills demonstrated

  • Privacy engineering
  • WebAssembly
  • Browser security (CSP)
  • Sandboxed processing
  • Self-hosted infrastructure
  • Product design
  • Trust documentation