1. Core Architectural Pillars
Our privacy model is founded upon four distinct browser technologies that render backend processing servers completely unnecessary:
A. Cryptographic Operations (W3C Web Cryptography API)
All hashing (SHA-256, SHA-512, MD5, HMAC) and random token generation utilize the browser's hardware-accelerated window.crypto.subtle subsystem. Data never crosses an HTTP boundary:
- W3C Standard: Compliant with the W3C Web Cryptography API Recommendation.
- Cryptographic Rigor: Conforms to RFC 6234 (US Secure Hash Algorithms) and RFC 2104 (HMAC: Keyed-Hashing for Message Authentication).
- Zero Network Egress: The plaintext key and message payload never leave your computer's RAM.
B. Image Processing (HTML5 Canvas & OffscreenCanvas API)
Tools such as the Exact KB Image Maker, Passport Photo Maker, and EXIF Cleaner process raw pixel buffers locally:
- Images are decoded directly via
createImageBitmap()orFileReader.readAsDataURL()into client memory. - EXIF metadata removal is performed by inspecting and stripping JPEG App1 markers (0xFFE1) in memory buffers before serialization.
- Lossy compression (JPEG, WebP) uses standard browser quantization matrices executed natively in the client's GPU/CPU.
C. PDF Manipulation & Document Generation (Client-Side WASM / JS)
PDF parsing, merging, splitting, watermarking, and rendering are executed via compiled WebAssembly and client-side byte manipulations:
- Byte streams are loaded into local
Uint8Arraybuffers. - New PDF catalogs and cross-reference tables are assembled in RAM and downloaded directly via generated Blob URLs (
URL.createObjectURL()). - No temporary files or document records are ever created on any remote server.
D. Deterministic Arithmetic (IEEE 754-2019 Standard)
All 24 financial, loan, and business calculators (EMI, Compound Interest, Profit Margin, Fuel Cost) adhere to the IEEE 754-2019 Standard for Floating-Point Arithmetic with decimal precision rounding guards to prevent binary floating-point representation drift.
2. Official Standards & RFC Citations
ToolMint's algorithms conform to authoritative international open standards:
| Domain | Standard / RFC | Specification Name |
|---|---|---|
| Encoding | RFC 4648 | The Base16, Base32, and Base64 Data Encodings |
| Identity & Tokens | RFC 7519 | JSON Web Token (JWT) Standard Format |
| Cryptography | RFC 6234 | US Secure Hash Algorithms (SHA and SHA-based HMAC) |
| Legacy Hashing | RFC 1321 | The MD5 Message-Digest Algorithm |
| Security Policy | RFC 9116 | A Format for Web Security Policies (security.txt) |
| Computation | IEEE 754-2019 | Standard for Floating-Point Arithmetic |
| Web Security | W3C WebCrypto | W3C Web Cryptography API (SubtleCrypto) |
3. How to Verify Zero Uploads (Self-Auditing Guide)
We believe in verifiable trust rather than marketing promises. You can audit ToolMint at any moment using your browser's built-in developer tools:
- Press F12 (or Ctrl+Shift+I on Windows/Linux, Cmd+Option+I on macOS) to open Developer Tools.
- Select the Network tab.
- Check the Preserve log box and select Fetch/XHR.
- Upload a large PDF, format sensitive JSON, or compress an image.
- Observation: Notice that zero HTTP requests are dispatched during processing. The output file is generated locally and downloaded via an internal
blob:URI. - You can even disconnect your Wi-Fi or enable Airplane mode after page load: every single tool continues to function without internet connectivity.
4. Authorship & Engineering Team
ToolMint was engineered and is actively maintained by Rishi Banota, a software engineer specializing in privacy-first web applications, client-side cryptographic systems, and performant web tooling.