Why everything runs in your browser, not on a server

The usual way to build a web tool goes like this: you upload a photo, a file or a recording, a server somewhere processes it, stores a copy “for quality purposes” and sends back the result. It works. It also means your photo now lives in two places, and you can only hope the second one is careful.

We went the other way. The page arrives, and then everything happens on your device: the measurements, the calculations, the conversions. Our server’s job ends when it has handed over the page. That’s why there are no accounts, no uploads and nothing to leak, and why most tools keep working without the internet once installed.

1What a modern browser can do

Much more than show pages. A few of the things our tools borrow from it:

• Sensors. The accelerometer, gyroscope and magnetometer turn a phone into a bubble level and a compass in ToolBench; the GPS gives coordinates in WhereBench; SmartBench even reads NFC tags in Chrome on Android.
• Camera and microphone. MeetBench checks them before a call, ScanBench finds the edges of a document in the camera image, and TuneBench hears the pitch of a string through the microphone.
• WebRTC, a direct line between two browsers. DropBench sends files and DrawBench shares a whiteboard over it, encrypted, with no server in the middle holding the data.
• WebAssembly, which lets real compiled programs run in a page at nearly native speed. That’s how PhotoBench encodes AVIF and WebP right on your phone.
• Everything else: graphics for the GPU test, background workers for the processor test, cryptographic randomness for PassBench, gamepads in KeyBench, stylus pressure in DrawBench, keeping the screen awake while you measure. Each of these used to be a separate app.

2Why all of this needs HTTPS

Browsers give the powerful features (the camera, microphone, location, motion sensors, offline mode) only to pages that arrive over an encrypted connection. The reason is simple: on an open Wi-Fi in a café, anyone in the middle could slip their own code into an unencrypted page, and that code would then ask for your camera on the site’s behalf. With HTTPS the page arrives sealed, exactly as we sent it.

fof.lol works only over HTTPS and tells browsers to never even try the plain version. If a tool can’t reach the camera or sensors, check that the address starts with https://: a saved copy of a page won’t get them.

3Why an iPhone asks for a tap

Android hands motion sensors to any secure page. Apple decided that’s too generous: from the tiny movements of a phone in your hand you can tell a surprising amount, up to guessing what is being typed, and some sites used the data to recognise devices. So Safari on iPhone and iPad gives a page the accelerometer and gyroscope only after you tap a button on that page and say yes.

That’s why ToolBench and SmartBench show a button that asks for access instead of just starting. If you said no by accident, our troubleshooting guide explains how to ask again.

4The honest list: the stops we can’t skip

Some jobs physically need the outside world. A speed test has to download something from somewhere, and a map can’t be drawn from nothing. Here is every outside service the site talks to, and what for. Your browser contacts them directly, so they see ordinary request data such as your IP address:

• Cloudflare (speed.cloudflare.com): test traffic for SpeedBench and MeetBench, and the server time for TimeBench.
• IP lookup services (geojs, ipwho.is, ipify): your provider and city in SpeedBench and PrivacyBench, and the approximate place in WhereBench when you ask for it.
• OpenStreetMap and Esri: map and satellite tiles in WhereBench and PhotoBench; OpenStreetMap Nominatim looks up addresses.
• PeerJS and Google STUN: they help two browsers in DropBench and DrawBench find each other. The files and drawings then go directly and encrypted; if a direct path is blocked, they pass through a relay that can’t read them.
• Have I Been Pwned: the PassBench leak check gets only the first 5 characters of the password’s hash, never the password.
• cdnjs and jsDelivr: ready-made libraries, such as the PDF reader, the QR code drawer or the image encoders. Code comes in, your data never goes out.
• The National Bank of Ukraine and Frankfurter: public exchange rates for MoneyBench. Only the rates come back; your sums stay on the page.
• Cloudflare Web Analytics: anonymous visit counts, without cookies and without anything after # or ? in the address.

And now the good news: KeyBench, TypeBench, ToolBench, TuneBench, RandomBench, TextBench, PowerBench, ColorBench, DevBench and ScoreBench talk to nobody at all except fof.lol. The full list with every address is in the Terms of use.

In short

Your browser is a very capable machine, and it is already in your pocket. We just ask it to do the work, over a sealed connection, with your permission, and only call the outside world when the job can’t be done without it. Fewer servers, fewer copies, fewer surprises.