TunaTools
119 professional-grade tools and 10 original games that run entirely inside the visitor's browser. No uploads. No sign-up. No servers touching user data.
Ownership — Independent product, engineered end-to-end: architecture, frontend, the deliberately minimal backend and the edge deployment are all my work.
- Type
- Browser-based utility ecosystem
- Scale
- 119 tools · 10 games · 5 languages
- Live since
- In production at tunatools.com
Project Introduction
TunaTools is a production utility platform built around one non-negotiable principle: user files never leave the device. Every conversion, compression, edit and export — PDF manipulation, OCR, audio transformation, video transcoding, background removal — executes 100% client-side using JavaScript and WebAssembly, while the platform is delivered from the Cloudflare edge as a lightweight core that stays fast no matter how large the catalog grows.
The suite serves four audiences at once: developers (a sandboxed code compiler with C/C++ via WebAssembly, QR codes, format converters), creators and marketers (social post designers, mockup generators, a timeline video editor, local audio tooling), students and professionals (eleven curated toolkits — Education, Finance, Legal, Health, SEO and more), and everyday users (a games arcade with daily challenges and optional anonymous leaderboards).
Problem Statement
The online-utility market has a structural trust problem. The typical tool site asks users to upload sensitive documents — contracts, ID scans, medical records — to unknown servers for processing, then monetizes attention with intrusive, sometimes hostile advertising. Processing server-side also means infrastructure cost scales with usage, latency scales with distance, and privacy becomes a policy promise instead of an architectural fact.
These platforms also bundle functionality into heavy first loads, lock basic utilities behind accounts, and treat non-English audiences as an afterthought — a poor fit for a global, mobile-first audience that just wants a tool to work, once, right now.
Project Objectives
- Make privacy an architectural guarantee, not a policy — zero server uploads by construction
- Keep the first visit fast regardless of catalog size (119 tools and counting)
- Remove every point of friction: no account, no install, no upload
- Deliver globally from the edge with a deliberately minimal server surface
- Monetize without hostile ads — protect both UX and trust
- Serve an international audience with first-class multilingual UI
My Role & Ownership
Solo engineering — every layer from architecture to deployment.
Independent product, engineered end-to-end: architecture, frontend, the deliberately minimal backend and the edge deployment are all my work.
Technical Architecture
The architecture inverts the usual utility-site model: the browser is the compute platform, and the server is reduced to static delivery plus one narrow API. A lightweight React SPA core ships on first visit; each tool arrives as its own tiny chunk fetched only when opened; heavyweight WASM engines stream from a public CDN the first time they are needed, with byte-level progress and automatic mirror fallback, then persist in a lifecycle-managed service-worker cache.
The only server-side API is an anonymous game-leaderboard endpoint backed by Cloudflare D1 — game scores only, never files. Static assets are served directly from the Cloudflare edge with zero worker CPU cost; only API routes and SPA fallbacks invoke the worker.
Technology Stack
Frontend
Client-side processing
On-demand engines
Code compiler
Backend & delivery
Quality & i18n
Database & Infrastructure
Edge delivery, zero worker CPU for static
Static assets are served directly from the Cloudflare edge network; the worker only handles API routes and SPA fallbacks — the app stays fast under load by construction.
Engine cache with lifecycle management
A strictly-scoped service worker caches heavy engines cache-first; idle payloads expire automatically and an emergency garbage collector frees storage when the device runs low.
Resilient route loading
Lazy chunks retry automatically after transient network failures, with a friendly error boundary as the last resort — flaky mobile connections degrade gracefully.
Hardened leaderboard service
The single API surface is origin-restricted, rate-limited on hashed identifiers (no raw IP storage), gated by single-use expiring session tokens, bounded by score plausibility checks, and retains data only for a capped window.
Key Features
PDF powerhouse — 18 tools
01Merge, split (by range or target size), multi-language OCR including Bangla, full convert pipeline (PDF ↔ Word/Excel/PowerPoint/Markdown), watermarking, password protect/unlock and digital signing.
Video & audio studio — 26 tools
02A timeline-based video editor sub-application, video-to-audio extraction, screen recorder, meeting transcriber, voice notes and a music copyright remover built on browser-side audio DSP.
Image & design toolkit
03Compressor, format converter, resizer, meme generator, festive flyer/card maker with Bangla typography, mobile screen mockup generator and photo cards.
Developer utilities
04An in-browser code compiler: sandboxed HTML/CSS/JS playground with live preview and console bridge, plus C/C++ compilation through a WebAssembly clang toolchain behind a Monaco editor.
11 professional toolkits
05Sixty additional focused utilities organized by profession — finance calculators, legal document templates, health trackers, SEO analyzers, classroom tools for teachers and more.
Games arcade
06Ten original games (2048, Sudoku, chess puzzles, Minesweeper and more) with keyboard and touch controls, daily challenges, local bests and anonymous online leaderboards.
Engineering Challenges & Solutions
Challenge 01
Catalog scale vs. first-load weight: some WASM engines measure in tens of megabytes — bundling them would make the first visit unusable on mobile data.
Solution
Two-tier lazy loading. Tools ship as 3–10 KB chunks fetched on demand; heavy engines are deliberately excluded from the bundle and stream from a public CDN on first use of the specific tool, with real byte-level progress feedback, mirror fallback and lifecycle-managed caching.
Challenge 02
Monetizing an ad-supported product without becoming the kind of site that hijacks tabs and destroys trust.
Solution
Ads render inside sandboxed iframes without top-level navigation rights; a structural allow-list guard neutralizes any injected overlay; placements live in a central, runtime-configurable registry — density can be tuned per page section without redeploying.
Challenge 03
Opening even one anonymous server endpoint invites abuse — bots, score flooding and scraping.
Solution
The leaderboard API combines origin-restricted CORS, rate limiting on hashed identifiers, single-use expiring session tokens, score plausibility bounds, input sanitization and capped retention — defense in depth on a deliberately narrow surface.
Challenge 04
Serving five languages (including Bangla and Chinese) without bloating the core bundle.
Solution
Locale chunks load lazily alongside tool chunks — a visitor downloads only the language they use.
Verifiable Outcomes
Statements verifiable via the live application and public architecture showcase
- 119 professional tools and 10 original games live in production at tunatools.com
- Zero backend data path for user content — the guarantee is architectural, not promotional
- The only server-side feature is an anonymous, opt-out game leaderboard
- Five interface languages with lazy-loaded locales
- 223-URL sitemap with JSON-LD structured data and a post-build verification script
Continue Exploring
Building something similar?
I take products from concept to production — architecture, engineering and deployment. Pick the channel that suits you.