No-upload processing removes a remote file-processing step, but it does not make a compromised browser, extension, device, dependency, or website harmless. Use a maintained browser, review unusually sensitive workflows, and work on copies of important files.
ToolGarden information
Security
ToolGarden reduces server-side exposure by processing supported tool inputs in the browser, while recognizing that delivered code, dependencies, analytics, and the user's own device remain part of the security model.
Last updated: 2026-08-03
Security boundaries
Engineering controls
The project uses a centralized tool registry, pure utility functions, static export hardening, a Content Security Policy, dependency review, and automated lint, type, build, and regression checks. Large libraries and models are loaded only by the tools that need them where practical.
- Tool workspace content is marked for Clarity masking.
- Source maps are removed from production exports.
- Hashed application assets are cached separately from navigational documents.
- Security-sensitive dependencies are upgraded or isolated when a compatible fix is available.
Report a vulnerability
Send a concise report with the affected URL, impact, reproduction steps, browser version, and any safe proof of concept. Do not include live credentials, private user files, or destructive test data. Please allow reasonable time for investigation before public disclosure.
What browser-local processing actually guarantees
"No upload" means precisely this: content you supply through the file picker, by drag and drop, or by pasting is never sent to any ToolGarden endpoint. It does not mean the page makes no network requests; the page itself, its JavaScript, its fonts, and the model files some tools need all come down from the network.
Put differently, this boundary is verifiable. Open the network panel in your browser's developer tools and exercise any tool: you should see downloads of static assets and model files, and no request carrying your file's contents. That is more reliable than any written promise, and you are welcome to check it yourself.
Where data can persist on your device
Most tools process purely in memory and release everything when the tab closes. A few exceptions leave traces locally, and you should know about them:
- Canvas tools; Whiteboard, Excalidraw Board, Mind Map; store their content in browser local storage so a refresh does not lose your work.
- Model files are cached after first download to avoid fetching them again; these are public model weights and contain none of your data.
- A Service Worker caches the pages and static assets that make offline use possible.
- All of the above can be removed at once with your browser's "clear site data" control.
Where this model does not help
Local processing removes one class of risk; your file sitting on someone else's server. It does nothing about a device that is already compromised, a browser extension reading page content, residue on a shared or public machine, or somebody simply reading your screen.
If your threat model includes any of those, or your organisation requires specific data to be handled inside an audited environment, use offline software that meets that requirement rather than any web tool; this one included.