I Built NoTrak 28 Free Privacy-First Browser Tools with No Accounts or File Uploads

[32bit]

I’ve been building NoTrak, a free collection of practical browser utilities designed around one principle:​

Process data on the user’s device whenever possible—and clearly explain every exception.​

Live website: You do not have permission to view the full content of this post. Log in or register now.
Browse all tools: You do not have permission to view the full content of this post. Log in or register now.

What makes NoTrak different?​

NoTrak currently provides 28 tools, with 23 operating entirely inside the browser.
There are:

• No user accounts
• No application database
• No uploaded copies of your files
• No saved tool history
• No advertising trackers
• No passwords or encryption keys sent to NoTrak
• No cloud file storage
  

Local tools use browser APIs for processing. After NoTrak’s application assets have been cached, these tools can continue working offline.
Tools that require an external service are clearly marked External lookup and explain exactly what information will leave the device.

Available tools​

Security

• Password Generator — Generates strong passwords using secure browser randomness.
• Password Safety Checker — Analyzes password strength locally, with an optional privacy-preserving Have I Been Pwned check.
• Passphrase Generator — Creates memorable multi-word passphrases locally.
• Phishing Checker — Performs explainable URL analysis and optional Google Safe Browsing and URLhaus reputation checks.
• Email Header Analyzer — Examines delivery paths, authentication results, and sender mismatches without uploading email headers.
• Malware Reputation — Calculates a file’s SHA-256 hash locally and optionally checks the hash with MalwareBazaar. The file is never uploaded.
• Text Encryption — Encrypts and decrypts messages locally using password-based authenticated encryption.

Privacy

• Tracking URL Cleaner — Removes common advertising and campaign-tracking parameters.
• Sensitive Data Redactor — Detects and replaces common emails, IP addresses, payment-card numbers, tokens, credentials, private keys, and URL secrets before text is shared.
• EXIF Viewer — Shows camera, date, and location metadata embedded in photos.
• Browser Privacy Check — Explains information an ordinary website can observe about the browser.
• QR Scanner — Reads QR codes from images or the camera without uploading frames.
• File and image utilities
• EXIF Remover — Creates a clean image copy without embedded camera metadata.
• Image Compressor — Reduces image file size locally.
• Image Resizer — Resizes images to precise dimensions without uploading them.
• Image Converter — Converts supported image formats locally.
• Image to Text — Uses a bundled Tesseract.js OCR engine to extract editable English text from screenshots and photos.
• File Encryption — Encrypts files locally before they are stored or shared.
• PDF Metadata Cleaner — Removes standard document metadata and creates a new PDF.
• PDF Toolkit — Merges, reorders, rotates, removes, extracts, and splits PDF pages locally.

Developer utilities

• Hash Generator — Generates SHA-256, SHA-384, or SHA-512 fingerprints for text and files.
• UUID Generator — Generates standards-based UUIDs locally.
• QR Generator — Turns text or URLs into downloadable QR codes.
• Base64 Converter — Encodes and decodes standard or URL-safe Base64.
• JSON Formatter — Formats, minifies, and validates JSON with useful error locations.
• JWT Decoder — Inspects JWT headers and payloads without falsely claiming to verify the signature.

Network tools

• What’s My IP — Displays the public address and approximate location visible to the connection.
• Speed Test — Measures download speed, upload speed, latency, jitter, and loaded latency using Cloudflare measurement endpoints.

The new Image-to-Text tool​

The most recent addition is a local OCR tool.
It supports:

• JPEG, PNG, and WebP
• File selection, drag-and-drop, and clipboard paste
• Exact image cropping
• 90-degree rotation
• Editable recognized text
• Copy and .txt download
• English printed-text recognition
• Offline reuse after OCR assets are cached

The OCR engine and language model are served as NoTrak application assets. The selected image and recognized text are not sent to an OCR provider.
OCR can still make mistakes—particularly with handwriting, blurry photos, columns, unusual fonts, and low-contrast text—so important information should always be checked against the original.

Honest external-lookup boundaries​

• Some tools cannot function without contacting another service. NoTrak discloses these cases before the request occurs:
• What’s My IP: the hosting infrastructure receives the normal request IP.
• Speed Test: measurement traffic goes directly to Cloudflare.
• Password breach check: only the first five characters of a SHA-1 identifier are sent to Have I Been Pwned. The password and complete hash remain local.
• Phishing Checker: after confirmation, the complete URL is sent through NoTrak to configured reputation providers.
• Malware Reputation: only the locally calculated SHA-256 hash is submitted. The file remains on the device.

A provider returning “not found” is never presented as proof that something is safe.

Offline support​

NoTrak installs a service worker that caches only the website’s own pages and application assets.

It deliberately does not cache:

• User-entered content
• Selected files
• Generated passwords or encryption keys
• OCR images or recognized text
• IP lookup responses
• Reputation-check responses
• Cross-origin measurement requests

Clearing the website’s browser data removes the cached application files.

Limitations​

NoTrak is a utility collection—not a replacement for professional security, forensic, legal, or incident-response tools.
Examples:

• OCR results can contain mistakes.
• A phishing reputation miss does not mean a URL is safe.
• A malware hash miss does not prove a file is harmless.
• Email authentication values are reported from pasted headers and are not independently verified through DNS.
• Sensitive-data detection is intentionally conservative and cannot guarantee that every private detail was found.
• Password-strength estimates are guidance, not exact crack-time predictions.

These limitations are documented directly inside the relevant tools and on the Methodology page.

Feedback is welcome​

I’d appreciate feedback from the community, especially around:

• Tools that would be genuinely useful to most people
• Privacy or security boundaries that could be explained better
• Accessibility improvements
• Mobile-browser compatibility
• Bugs and incorrect results
• Additional local-only tools

If you test it, please let me know which tools you find useful and what you think should be improved next.
You do not have permission to view the full content of this post. Log in or register now.
You do not have permission to view the full content of this post. Log in or register now.