Nicely Done — home
ع

Your files stay yours.

No ads, no trackers, no analytics. Almost everything happens on your own phone or computer. Here is exactly what goes online, what never does, and how you can check it yourself.

01

Check it yourself

You don’t have to take my word for it. On a computer, it takes about ten seconds:

  1. Open any tool — the PDF Studio is a good one to try.
  2. Press F12 (or right-click → Inspect) and open the Network tab.
  3. Add a file and work on it. Nothing gets sent — the list only shows the page’s own files loading.
  4. Or simply turn off your Wi-Fi after the page has loaded. It keeps working.
02

What does go online

A few things can’t work without the internet. Here is exactly what they send, in plain words:

Pages, fonts and iconsFrom my own server — no outside companies
PDF Studio, password, hash, text and date toolsNothing — all on your device
Reading text from scans (the first time)Downloads the reader from my server once — your scans stay on your device
Leaked-password check5 scrambled characters to Have I Been Pwned — never the password
Link checkerA few scrambled characters of the link — never the link itself
One-time secret linksLocked text only — the key never reaches me
VaultLocked data only — I can’t open it
Speed testMy server only — your results stay with you
Your IP address (IP & Network page)A public IP service
Sign in and your accountMy server — only if you make an account

For the speed test, your IP address is kept in memory — never saved — for up to an hour, only so one person can’t hog the test. The only cookie on the site is the sign-in one, and only if you sign in.

03

For the technical folks

Everything is served over HTTPS. Account passwords are hashed with bcrypt (cost 12); sessions use an HTTP-only, same-site cookie; email links are stored only as SHA-256 hashes and expire. Two-factor sign-in uses standard TOTP codes. The vault and one-time secrets are encrypted in your browser with AES-256-GCM, so the server only ever holds data it can’t read. Generators use crypto.getRandomValues with rejection sampling, so every character is equally likely.

Passphrases use the EFF Short Wordlist (CC BY 3.0 US). PDF Studio uses pdf.js, pdf-lib and Tesseract.js — all open source.

04

Found a problem?

If you find a security problem, please tell me before telling anyone else, so I can fix it first. Here’s how to reach me.