Research question
Can a static website provide security utilities that are genuinely useful, privacy-conscious and clear about their limits? We built the catalogue around tasks a browser can perform deterministically on user-supplied text or files: parsing, encoding, hashing, cryptographic random generation, structural review and standards-based explanation.
Selection method
Each proposed tool had to satisfy four tests: it works without unauthorised network probing; its core result can be reproduced in modern browsers; a primary technical source defines the behaviour; and the page can state what the result does not prove. Tools that needed server-side network access, privileged system access or a deceptive “scan” label were excluded from the local catalogue.
- Deterministic local input and output
- No claim of scanning a third-party target
- A standards or authoritative methodology source
- A visible limitation and safe-use note
Implementation checks
The validation suite confirms that every catalogue entry has a dedicated page, a working implementation registration, indexable metadata, source attribution and internal links. Cryptographic generation uses the browser Web Crypto interface. File hashing reads the selected file locally. Parsers report malformed input rather than silently producing a confident result.
Known limitations
A browser tool cannot see response headers from an arbitrary external site without that site permitting cross-origin access. It cannot prove that pasted source matches production, validate server configuration from text alone or replace an authorised penetration test. Some checks are advisory because standards allow context-dependent choices.
What we will measure after launch
With consent-respecting analytics configured, we can measure tool starts, successful results, repeat use, downstream guide views and qualified enquiries. We will not publish outcome claims until the observation window, methodology, exclusions and sample size can be stated.