24 free tools & projects

Every tool you need.
Nothing leaves your machine.

A lab bench of 24 free tools, games & projects — plus an MCP endpoint so AI agents can drive the whole suite. No uploads, no accounts, no trackers. The code runs on your device; your files never leave it.

See the tools → Agent Mode docs

free tools & projects

uploads, ever

automated checks per release

98–100

Lighthouse, every page

accounts, cookies, trackers

∞

file size limits (your device decides)

01 · 🤖 For AI agents, too

Suite automation for humans — and for machines

Every tool is scriptable. Drive them from an AI agent with a Model Context Protocol endpoint, or with plain parameterized URLs — the same pages, the same privacy: files stay on the device running the browser.

MCP endpoint

JSON-RPC 2.0 at POST /tools/mcp — initialize, tools/list, tools/call. Compute tools: catalog, QR payloads, text diff, text stats. Stateless, no auth, protocol 2025-06-18.

Deep links with parameters

Every page accepts a strict allow-list of URL params — qr.html?text=… renders instantly, shrink.html?url=…&targetKB=300 pre-loads and pre-sets. ?url= is same-origin only, enforced in code.

Machine-readable docs

llms.txt + llms-full.txt at the site root, tools.json as data, and a full reference page — so an agent can discover and drive the whole suite without a human.

agent-mode — try it

# list every tool the suite exposes to agents
curl -s -X POST https://navigatorslab.com/tools/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq '.result.tools[].name'

Read the Agent Mode docs →

02 · Verified, not promised

Real examples, real numbers — from the actual verification runs

Every claim below is asserted by an automated browser test on every push. These aren't marketing numbers; they're test results.

🛡️ Photo Privacy Kit

You: posting beach photos, unaware your phone wrote the hotel's coordinates into every JPEG.

41.0000°N, 29.0000°Efound and flagged

0 bytes re-encodedimage quality untouched

GPS leak flagged red → stripped → output JPEG has no EXIF segment at all, byte-identical picture.

🗜️ Image Shrinker

You: "Attachment exceeds maximum file size." The portal wants 2 MB; your scan is 16.

16.0 MB → 294 KBin one click, no upload

8 iterationsof binary-searched quality

Lands under your exact target — and the downloaded file is checked against the limit by the test suite.

✍️ Local E-Sign Pad

You: "Sign and send back tonight." No printer. No DocuSign subscription. 11pm.

~30 secondsdraw → click → flatten

6 KB PDFwith signature burned in

The signature is flattened into the page — no editable field, just ink. The test asserts it's inside the PDF's resources.

🔢 Receipt OCR → CSV

You: twelve crumpled receipts, one expense spreadsheet, zero motivation.

"GREEN GROCER" → 23.98read on-device at 95% confidence

~11 MB enginedownloaded once, then fully offline

Totals land in editable rows — fix anything OCR misread, export expenses.csv for Excel or Sheets.

📄 Scan & Screenshot Cleaner

You: a 3-page contract photographed crooked on a gray desk.

±4° auto-straightencontent-aware skew search

1275×1875 pxexact 300 DPI print pages

Crop, straighten, grayscale, stack → one clean PDF. The crop drag is regression-tested to land exactly where you drew it.

🔳 QR Studio

You: a guest asks for the Wi-Fi. Generator sites would log that password.

29×29 modulesin ~30 ms, on your screen

PNG + SVGprint-crisp at any size

Round-trip proven: encode → export → decode returns the exact payload, character for character — tested in CI and on production.

🔐 Password Breach Checker

You: "Is my go-to password already out there?" Checking online would mean handing the password to a stranger.

5 hash charactersleave the browser — never the password

exact breach countfor every password ever breached

K-anonymous lookup against Have I Been Pwned: your browser hashes the password with SHA-1, sends only the first 5 characters, and matches the returned candidates in your tab. A hit names the exact breach count.

Check a password →

03 · Head to head

Same tools you'd pay for — without the catch

The tools you know, minus the uploads, accounts, watermarks, and monthly fees. And unlike them, this suite is verified — every release runs a 150+ check gate that drops real files in and validates the downloaded bytes.

Tool	Runs on	Network after load	Output verified by
🛡️ Photo Privacy Kit	Byte-level EXIF parser	nothing	APP1-segment absence in output JPEG
🔍 Metadata Checker	EXIF + PDF + OOXML readers	nothing	Cleaned files re-inspected
🗜️ Image Shrinker	Canvas + binary search	nothing	294 KB ≤ 300 KB target
📄 Scan Cleaner	Canvas + pdf-lib	nothing	Page count + crop size in output
✍️ E-Sign Pad	pdf-lib (+ pdf.js preview)	nothing	Signature image in PDF resources
🧾 Receipts → PDF	EXIF + pdf-lib	nothing	3 stamped pages, correct order
🔢 Receipt OCR → CSV	Tesseract (self-hosted WASM)	nothing*	Line items parsed in CSV
🔳 QR Studio	qrcode-generator + jsQR	nothing	Generate → decode round-trip matches
📑 PDF Pages	pdf.js render + pdf-lib rebuild	nothing	Page order & rotations in rebuilt PDF
🔬 Text Diff	LCS engine (unit-tested)	nothing	Word-level spans asserted
📊 Text Stats	Stats engine (unit-tested)	nothing	Counts & keywords asserted
🎧 Audio Trimmer	Web Audio + lamejs	nothing	WAV data-chunk = exact selection
🧮 Invoice Generator	Canvas + pdf-lib	nothing	$408.00 total in exported PDF
🗂️ Batch Rename	EXIF + JSZip	nothing	Renamed entries inside ZIP
🖨️ Print-Shop Prep	Canvas + pdf-lib	nothing	MediaBox = 306 pt (4.25 in)

* OCR downloads the Tesseract engine and English model from this same site on first use — after that it's cached and fully offline. No third party ever sees your images.

04 · Straight answers

Questions people actually ask

In your browser tab, on your device. Each tool is a static page with JavaScript that reads your file into memory, processes it with Web APIs (Canvas, Web Audio, WASM), and offers the result as a download. Close the tab and it's gone.

No, and no. There is no upload endpoint, no queue, no storage bucket — nothing that could receive a file. The security suite proves this on every release: it loads every page, watches every network request, and asserts that nothing goes anywhere but this site — except one deliberate, user-initiated exception: the Password Breach Checker sends 5 characters of your password's SHA-1 hash to Have I Been Pwned only when you press Check, so it can search 800M+ breached credentials. Your password itself never leaves the tab.

No catch, no tier, no watermark, no "upgrade to unlock bigger files." MIT licensed — take the code and self-host it if you like. The only limit is your device's memory.

Yes — after your first visit, the service worker precaches every page and engine (including the 24 MB OCR model). A test literally turns the network off and runs a tool to prove it.

NavigatorsLab — a lab for local-first, private-by-default software. The suite's big sibling is PDF Studio, a full in-browser PDF editor.

05 · The guarantee

Privacy isn't a promise here. It's the architecture.

These are static pages. There is no server that could receive your files — no upload endpoint, no queue, no storage bucket, no analytics, no cookies, no accounts. We keep no attachments and no user information, ever. Open devtools → Network, load any tool, and watch it stay silent after the initial load. The single exception is deliberate and user-initiated: the Password Breach Checker sends only the first 5 characters of your password's SHA-1 hash to Have I Been Pwned when you press Check — the password itself never leaves your device.

CSP: default-src 'none' · script-src 'self' · connect-src 'self' (+ api.pwnedpasswords.com, breach checker only, only on Check)