When you open a typical “free” online tool — a PDF merger, an image compressor, a passport photo cropper — the first thing it does is ask you to upload your file. Within seconds, that file leaves your device, travels across the internet, and lands on a server you have never heard of, owned by a company whose privacy policy you have probably never read. The server does the work, sends back a result, and then? Maybe the file is deleted in 24 hours. Maybe in 30 days. Maybe never. You have no way to know, and the site has no obligation to tell you.
This server-side model is the default for one simple reason: it is easy. Building a web app that processes files on a remote server uses the same techniques developers have used for twenty years — accept an upload, run a script, return a result. The browser, until quite recently, simply was not capable of doing heavy work like decoding a PDF, recompressing a JPEG, or running OCR. So the industry standardised on upload-first tools, and we all got used to the trade-off.
The cost of that trade-off is steep. Tax returns, medical records, signed contracts, passport photos, identity documents, family pictures — all of these routinely pass through the servers of random web tools. Each upload is a new breach surface, a new subpoena target, a new entry in an analytics pipeline you cannot inspect. Even when the operator is honest, their hosting provider, their CDN, their database vendor, or a downstream attacker may not be. And the moment a tool becomes popular enough to be worth attacking, it will be.
Modern browsers have quietly closed the capability gap. OffscreenCanvas lets us decode and re-encode images in a Web Worker without blocking the UI. createImageBitmap honors EXIF orientation and supports high-quality resampling. WebAssembly brings native-speed codecs and PDF engines into the page. The File System Access API lets users grant a page direct read/write access to local files without any round-trip. A modern phone or laptop is dramatically faster at image work than the average cloud function — there is no longer a performance reason to upload.
FormFix is built on this premise. Every tool — compress, resize, merge, split, rotate, OCR, signature, QR — runs entirely inside your browser tab. Your file is read into memory, processed by your own CPU, and offered back to you as a download. The Network tab confirms this: zero file traffic to any origin. When you close the tab, the data is gone. No copies, no logs, no retention, no analytics on your content. The only request that leaves your device is for the static HTML, CSS, and JS that make up the tool itself.
There is one more benefit that does not get talked about enough: speed. A server-side tool has to receive your file, queue it, process it, and stream the result back. On a slow connection that round-trip alone can take longer than the work itself. A client-side tool starts working the instant you drop the file. For most everyday tasks — compressing a 4 MB photo to 50 KB, merging two PDFs, generating a QR code — the result is ready before a server-side equivalent would even have received the upload. Privacy and performance, it turns out, point in the same direction.
This is why we believe client-side is not just a feature but the right default. Tools should respect the user’s data by default, not as an opt-in. They should be auditable, forkable, and usable offline. They should keep working when the company that made them disappears. FormFix is a small step in that direction — open-source, dependency-light, and built so that the only machine that ever sees your files is the one in front of you.