Most Tool Plaza utilities are browser programs, not forms that upload your input to a server. When you convert Base64, hash a string, or check an IBAN checksum, the work happens in JavaScript on your device. That design is why the site can keep request bodies off our logs and still publish a long guide next to every tool.
This article explains what “runs in the browser” means in practice, where the exceptions are, and how the same helper logic is exposed to agents without turning public pages into empty widgets.
Why browser-first matters
A converter that never sends your paste buffer to a backend cannot leak that paste in an application log. It also cannot silently change results after you leave the page: what you see is the same function the tests cover in shared helpers. We document that behavior in each user guide rather than burying it in a privacy-policy footnote.
Browser-first does not mean “no server at all.” Pages are statically generated and served from our origin. Programmatic skills call the REST execute API or A2A JSON-RPC. Those endpoints run the same helper exports the UI uses, with rate limits and a payment guard for paid skills. They still do not store your arguments as analytics content.
What still happens on the server
A few tools generate sample records through server actions because they read datasets we do not ship to every client bundle. Those pages say so in their guides. Timers, canvas converters, and other DOM-only tools are not execute skills; they stay in the tab.
If a guide shows an amber disclaimer—health estimates, generated test IBANs, entertainment horoscopes—that text is part of the documentation on this domain. The blog is for site-level topics; per-tool formulas stay on the tool pages.
Limitations
This is not a promise that every future tool will be fully client-side. Media codecs, large dictionaries, and legal-sample generators may keep using the server. When they do, the page must say so. Treat educational calculators as education, not medical or financial advice.
Agent callers should read the skill schema from the helper metadata API instead of scraping the HTML form. The HTML is for people; the helper export is the contract.