Blog
Long-form posts on offline-first developer tools, browser APIs, JSON and JWT internals, and the small everyday tradeoffs of building privacy-first software.
All posts
- Privacy12 min read·
Which AI coding tools train on your code? A 2026 privacy guide
Whether an AI coding assistant trains on your code or keeps it private usually comes down to one thing: your subscription tier, not the tool. Here's a current, tier-by-tier breakdown of what GitHub Copilot, Cursor, Claude Code, ChatGPT and Gemini actually do with the code you send them — how to lock each one down, and when the only real guarantee is a local model.
Read post
- Security10 min read·
Vibe coding safely: shipping an AI-built app without leaking secrets or bugs
Vibe coding — describing what you want and letting an AI write most of the code — is a genuinely fast way to build. It is also a fast way to leak API keys, install a hallucinated package, and ship an app you do not understand well enough to secure. Here is a practical threat model and a safe workflow that keeps the speed without the accidents.
Read post
- Concepts9 min read·
AI vs automation: when an LLM wins and when a script wins
The useful question is not whether AI or traditional automation is better — it is which one fits the shape of the task. This is a decision framework built on the five properties that actually decide it: how deterministic the job is, how structured the input is, the volume, the auditability, and the privacy exposure.
Read post
- Engineering9 min read·
Should you build your own developer tools? Build vs. use vs. generate
The urge to build your own version of a tool is strong — and sometimes right, often a trap. There are three options, not two: use an existing tool, build one, or have AI generate one. Here is a decision framework, the real total cost of building, and the short list of things you should almost never build yourself.
Read post
- Privacy7 min read·
Is offlineutils.com safe? An honest, verifiable answer
Yes — offlineutils.com is safe to use. Every tool runs entirely inside your browser, so the files and text you work with are never uploaded to a server, and there are no accounts, no cookies, and no tracking scripts. Here's exactly why it's safe, what data is and isn't collected, and how to verify every claim yourself in under a minute.
Read post
- Comparisons8 min read·
Smallpdf and iLovePDF alternatives that never upload your files
Smallpdf and iLovePDF are reputable, but both work by uploading your document to their servers, processing it there, and deleting it afterwards. If you'd rather your file never leave your device at all, the strongest alternative is a set of in-browser PDF tools that do the work locally. Here's an honest comparison of when each approach wins.
Read post
- Comparisons7 min read·
TinyPNG alternatives: shrink images in your browser without uploading
TinyPNG's compression is genuinely excellent — but it uploads your image to its servers to do the work. If your image is sensitive, or you just don't want the upload, client-side tools like Squoosh and the image tools on offlineutils.com resize, convert, and strip metadata entirely in your browser. Here's an honest comparison.
Read post
- Comparisons6 min read·
CyberChef alternatives: focused in-browser tools for everyday encoding
CyberChef is a powerful, fully client-side Swiss Army knife — but for a single common task like decoding Base64 or inspecting a JWT, its 300-operation recipe interface is overkill. Here's an honest look at focused, single-purpose alternatives that are just as private and faster for the everyday jobs, plus when CyberChef is still the right tool.
Read post
- Privacy8 min read·
Why offline-first developer tools matter in 2026
Paste-and-upload developer tools have a long history of accidental leaks. Browser-only utilities sidestep the entire category of risk by computing locally — here's the case for offline-first, the actual incidents that motivate it, and how to verify a tool is what it claims to be.
Read post
- Privacy5 min read·
We added analytics — here's exactly what we can and can't see
I turned on Vercel Web Analytics to learn whether anyone actually uses these tools. It's cookie-less, stores no IP address, and can't identify you — and the data you paste into a tool still never leaves your browser. Here's exactly what it can and can't see, and how to verify all of it yourself.
Read post
- How-to6 min read·
JSON formatter vs jq vs your editor: when to reach for which
Three tools cover almost every JSON task developers face — a browser-tab formatter, jq in the terminal, and the editor's built-in formatter. They overlap, but each one is meaningfully better for a specific kind of job. Here's how to pick.
Read post