Stayput

Convert HEIC photos from an iPhone, merge, split, sign and compress PDFs, shrink images and strip GPS and EXIF data. Every tool is a static page and a bit of JavaScript and WebAssembly that does the work in your tab. There is no server that could receive your files.

Open the network tab. Your files never appear in it.

That is the whole pitch, and you can check it in three ways:

1. Watch the network. Open your browser's developer tools (F12, or Cmd-Option-I on a Mac), pick the Network tab, open any tool and drop a file. You will see requests for the page's own code, the site's own decoder files on the pages that need them, and one anonymous page count. You will never see a request carrying your file, because there is nowhere for it to go. Every tool page also counts its own requests after you add files and shows you the list.
2. Turn the network off. Load a tool, switch to airplane mode, and use it. It keeps working, because after one visit the site is cached by a service worker and the work happens in your tab.
3. Read the code. This repository is the site. It builds to static HTML, CSS and JavaScript with no backend; the deploy has no server-side code at all. The privacy page lists every request the site makes.

Tools

Plus dedicated pages for the jobs people search for: image conversions such as HEIC to PNG, PNG to JPG, WebP to PNG, AVIF to JPG and JXL to PNG; tool presets such as JPG to PDF, PDF to JPG, Combine PDF, Resize image, Crop to circle and Remove location from photos; and guides that answer the question behind the tool ("is it safe to merge PDFs online?", "how do I remove location data from photos?").

MCP server

Stayput also ships as a local Model Context Protocol server, stayput-mcp, so an LLM client can call the same PDF and photo tools as tool calls, still with no network access and no uploads:

{ "mcpServers": { "stayput": { "command": "npx", "args": ["-y", "stayput-mcp"] } } }

See mcp/README.md for the full tool list, or stayput.dev/mcp.

How it works

The site is a static Astro build: one page per tool, a shared tool shell, and a TypeScript module per tool that does the work in the tab. The MCP server (above) is the one part of this repo that does run as a local process; everything else described below is the browser-only website.

• HEIC decoding: heic-to, a WebAssembly build of libheif, served by the site itself from /vendor/ (copied out of node_modules at build time by scripts/vendor.mjs). The request fetches only the decoder; no image data is sent.
• PDF editing: pdf-lib for merge, split, rotate, reorder, page numbers (standard fonts, nothing embedded), signature stamps, image embedding and rewriting image streams.
• PDF to Word: pdf.js reads the positioned text runs; src/lib/pdftext.ts rebuilds lines, paragraphs and headings and src/lib/docx.ts writes a minimal Office Open XML document with fflate. Text and structure only, no layout.
• PDF rendering: pdf.js (legacy build for wide browser support) on a dedicated web worker.
• Image resize and encode: the canvas API, with stepped downscaling for sharp results.
• Encrypted PDFs: many PDFs carry "owner" encryption with an empty user password (statements, forms with printing restrictions). pdf-lib cannot read those streams, so every PDF tool first checks the trailer for /Encrypt and, when found, runs qpdf compiled to WebAssembly (@neslinesli93/qpdf-wasm, served from /vendor/ and loaded only when needed) to strip the encryption in the tab. Files with a user password prompt for it once; outputs are written without encryption. See src/lib/unlock.ts.
• AVI decoding: most video runs on your browser's WebCodecs through Mediabunny. For old formats the browser cannot read, the page loads a decoder built from FFmpeg's libraries (LGPL) only when you convert such a file. Today that is AVI (Xvid and DivX 4+, Motion JPEG; MP3, MP2, AC-3, PCM sound) and 3GP (H.263 and MPEG-4 picture, AMR sound; builds in vendor-builds/libav-3gp/, worker src/lib/threegp-decode.worker.ts). The decoder is libav.js 6.10.9.0 with a short component list; the build script, the list and the patent-expiry evidence for each codec are in vendor-builds/libav-avi/ and docs/research/avi-decoder-codec-patents-2026-10.md. The built files are committed and scripts/vendor.mjs copies them to /vendor/libav.js@6.10.9.0/; the conversion runs in a module worker (src/lib/avi-decode.worker.ts), and the file never leaves the tab.
• WMA decoding: a second, smaller build of the same FFmpeg libraries (LGPL) with only the ASF demuxer and the Windows Media Audio 1 and 2 decoders, loaded only when you convert a WMA to MP3. WMA Pro, WMA Lossless and WMA Voice are left out on purpose and refused by name. The build script, the component list and the reasoning are in vendor-builds/libav-wma/ and docs/research/wma-decoder-codec-patents-2026-10.md; the conversion runs in a module worker (src/lib/wma-decode.worker.ts), and the file never leaves the tab.
• FLV reading: FLV is a container no browser opens, so the page loads a second, smaller libav.js build (the FLV demuxer and the MP3 decoder, nothing else) only when you convert an FLV. The H.264 picture and AAC sound are copied into the MP4 packet by packet and not decoded; MP3 is decoded and written as AAC. VP6, Sorenson Spark and other codecs have no decoder in the build and are refused by name. The build script, config and patent reasoning are in vendor-builds/libav-flv/ and docs/research/flv-reader-codec-patents-2026-10.md; the worker is src/lib/flv-decode.worker.ts.
• JPEG XL and AVIF decoding: the browser's own decoder when it has one (AVIF everywhere, JXL in Safari); otherwise the jSquash WebAssembly builds of libjxl and libavif, served from /vendor/ like the HEIC decoder. Tool pages that accept these formats ask the service worker to cache the decoders they may need (only JXL/AVIF decoders the browser lacks) and mark <html data-decoders="cached"> when they are in, so they work offline after one visit; the service worker does not precache them for every visitor because together they are about 6 MB. See src/lib/vendor.ts.
• Signatures: drawn on a canvas with pointer events (pressure-aware for pens) or typed in the self-hosted Caveat font, cropped to a transparent PNG and placed at preview coordinates mapped into PDF user space, page rotation included.
• EXIF removal: a hand-written, lossless segment and chunk editor for JPEG, PNG and WebP in src/lib/exif.ts. It deletes only the metadata segments and writes the image data back unchanged, so the pixels are identical and the file only gets smaller. The one exception is the tool's "Apply orientation" option (on by default), which re-encodes a JPEG stored sideways at quality 95 so it displays upright; the MCP server never does this. It also extracts EXIF from HEIC containers so "keep metadata" works on HEIC conversions.
• TIFF input: [UTIF.js](https://