About DuckyTools
300+ tools, one rubber duck, and a rule we do not break.
The rule
Your files never leave your device. Not to be processed, not to be scanned, not "temporarily". DuckyTools has no upload endpoint, no storage bucket and no processing queue, because every tool here runs as JavaScript in your own browser.
This is not a promise about how carefully we handle your data. It is a statement about architecture: there is nowhere for your data to go.
Why that matters
The popular online tool sites all work the same way — you upload a file, their server does the work, you download the result. That means your contract, your medical scan, your passport photo and your unreleased financial statements all end up on somebody else's disk, however briefly.
Most of the time nothing bad happens. But "most of the time" is a strange standard for a document you would not email to a stranger.
How it is built
- A static site — plain HTML, CSS and JavaScript, no backend at all.
- PDFs are handled by
pdf-libandpdf.js, loaded on demand. - Images run through the browser's own
<canvas>. - Audio uses the Web Audio API; hashes use the built-in WebCrypto engine.
- No analytics, no cookies, no fonts or scripts fetched from anyone else.
What is actually enforced
"No uploads" is architecture, not policy — but a few things here are policy, and it is worth being exact about which is which.
Every page ships a Content Security Policy in its markup. It restricts what the page may load and where it may send anything, and your browser enforces it whether or not we behave. You can read it in the page source. It has one third-party allowance, cdn.jsdelivr.net, reached only if you run optical character recognition in a language other than English — English is served from here, so the common case makes no external request at all.
One protection we cannot deliver on this host: frame-ancestors, which stops other sites embedding this one, is only honored as a real HTTP header, and GitHub Pages serves its own fixed headers. The proof page covers the claim that matters more — it runs a real tool and counts every request your browser makes.
What it costs
Nothing, and there is no upgrade to sell you. No accounts, no daily limits, no watermarks, no "sign in to download". Because the tools run on your hardware rather than ours, serving one more person costs approximately nothing.
Who Ducky is
Ducky is a rubber duck. Rubber ducks have a long and honorable history in software — you explain your problem to the duck, and halfway through explaining it you work out the answer. This one just happens to also merge your PDFs.