Local-first / verifiable boundaries
Trust should be visible in the design
TabPebble does not ask you to trust a privacy slogan. Local browser processing, explicit safeguards, and narrow technical boundaries make the promise observable.
Processing boundary
Inputs and results for all 32 current tools are processed in the browser. Text, tokens, passwords, IP addresses, images, videos, and PDFs are not sent to TabPebble servers as part of a tool task. Pages, code, and on-demand modules still load from the site. If the browser rejects HEVC/H.265, an approximately 32 MB FFmpeg WebAssembly decoder loads on demand from the same site without sending the video contents.
No account data
The current version has no signup, user profile, cloud history, or sync. The application does not write tool inputs or results to a database, localStorage, or sessionStorage; the browser may still restore a tab, and the device retains downloads and clipboard copies.
Cryptographic primitives
Passwords, random strings, and UUIDs use browser Web Crypto rather than Math.random(). The JWT tool decodes without claiming signature verification, and the SHA-256 page explains that a plain digest is not password storage.
Local workload safeguards
Text tools accept up to 1,000,000 Unicode characters per input. Image/Base64 conversion is capped at 10 MB per image. Still images are capped at 50 MB, 40 megapixels, and 16,384 pixels on either side; collage work holds up to 9 images and 150 MB combined. A single ID photo is 64–2,000 pixels per side and at most 4 megapixels; print sheets are capped at 16,384 pixels per side and 40 megapixels. Physical units convert through explicit DPI, and flat-color background replacement is not AI segmentation. GIF files are capped at 150 MB, 240 frames, and 1,920 pixels per side, with an estimated-memory guard at 72 million decoded pixels; video input is capped at 200 MB and only clips up to 12 seconds are processed. HEVC/H.265 fallback conversion also has a 180-second execution limit. Frame extraction outputs no more than 120 PNG files. PDF workflows allow up to 150 MB combined, 200 selected files, and 2,500 PDF pages per task. File tools reject empty input and validate actual file headers or local decoding results.
Observable site constraints
Current responses set no TabPebble application cookie. The Content Security Policy limits browser connections, scripts, fonts, and assets to the same origin plus the local blob/data sources needed by tools. Framing, object plugins, camera, microphone, geolocation, and payment permissions are disabled. Fonts and brand assets are served with the site.
Site requests and third parties
Cloudflare hosting still receives ordinary HTTP request data needed to deliver pages and prevent abuse. The current product loads no ads, marketing trackers, or third-party analytics scripts; site-request data and tool-task data are separate boundaries.
Your device remains a boundary
Local processing cannot protect a device already controlled by malware, browser extensions, or another person, and cannot guarantee that a browser never restores tab state. Trust the device, browser, and extensions, and keep original-file backups.
Changes require disclosure
If accounts, cloud processing, analytics, or advertising are introduced, TabPebble will first explain new data flows, providers, purposes, retention, and user choices. The operator is Liu Xing (刘星), reachable at liux1506@outlook.com.
Last updated
2026-09-26