DuckyTools
HomeChangelog

Changelog

What shipped, when, and what was broken before it. Newest first.

A domain of its own

  • Changed DuckyTools now lives at duckytools.com. Every canonical URL, sitemap entry, Open Graph tag and machine-readable file follows from a single line of configuration, so the move was that line — and a test now checks that the domain file and the canonicals can never disagree.
  • Fixed The build was not reproducible. Two files carried a clock reading rather than a date, so every deploy rewrote them whether or not anything had changed. Both now derive from the build date, and a check builds the site twice and compares all 419 files.
  • Fixed The continuous integration pipeline had never run once. It was configured to trigger on a branch this repository does not have, so every deploy so far had been made by hand, and the test suites that gate a release were gating nothing.

A real Content-Security-Policy, and the hole it found

  • Fixed The Tool Builder parsed tool definitions on the main page rather than inside its sandbox. Definitions travel in the URL hash, so a share link could have run a stranger's code with access to this site's storage — the exact thing the sandbox was there to prevent. Parsing, previewing and exporting now all happen inside a frame with its own opaque origin, and the page only ever handles the definition as text.
  • Added A Content-Security-Policy that browsers actually enforce. It was previously written only into a `_headers` file, which is a Netlify and Cloudflare Pages convention that GitHub Pages ignores — so the policy was documentation, not protection. It now ships in the markup of every page, which works on any host.
  • Fixed Two directives in that policy were wrong in ways that only appear once it is enforced: WebAssembly was not permitted, which would have broken OCR and background removal, and audio and video previews were not permitted, which would have broken the media tools.
  • Note One protection cannot be delivered this way: `frame-ancestors`, which stops other sites embedding this one, is only honored as a real HTTP header. On GitHub Pages it is absent. The About page says so rather than implying otherwise.

On-device AI, OS integration, tool chaining and a proof page

  • Added AI Background Remover — a real ISNet segmentation network running through ONNX Runtime in your browser, with zero requests to any other origin. Every comparable service uploads your photo; this downloads the model instead.
  • Added Tool chaining. Every result now offers "Send to another tool", carrying the file in memory with no download between steps.
  • Added Operating-system integration: DuckyTools appears in "Open with" for PDFs, images, text and audio once installed, accepts the Android share sheet, and has icon shortcuts.
  • Added A proof page that runs a real tool while counting every network request the browser makes. It stays at zero.
  • Added A command line over the same tool definitions, covering every tool that can run without a browser.
  • Fixed The build was not reproducible: the mascot generated a random SVG gradient id on every render, so four pages produced a different byte stream on every deploy.
  • Fixed The sitemap stamped all pages with the build date, telling search engines the entire site changed on every deploy. Dates now come from page content and only move when a page actually does.

An AI & Writing category, and American English

  • Added Thirteen tools for working with model output: em dash remover, AI text cleaner, writing-tells analyzer, token counter, cost calculator, prompt tooling and a chat transcript formatter.
  • Added CSS clamp generator, markdown table generator, number formatter, duplicate word finder, sentence splitter, text truncator and regex escape.
  • Changed The site is now written in American English. No URL changed.
  • Note Nothing in the AI category claims to detect AI authorship, because nothing can. The analyzer measures writing style and says so on the page.

An SDK, a tool builder, and a file finder

  • Added @duckytools/sdk — the tool contract published as a zero-dependency package. The site's own build validates its catalog through it, so the documented standard and the enforced one cannot drift.
  • Added Tool Builder: write a tool definition in the browser, watch it mount, download it as a single self-contained HTML file.
  • Added What Can I Do With This File? — identifies a file from its opening bytes rather than its name, then routes it to the tools that accept it.
  • Added cURL to fetch, Unicode inspector, invisible character detector, JSON diff, Base32, hex converters, HTML table extraction, time zone converter and more.
  • Changed Ducky mode is now the default theme, and is set in the markup so it renders with JavaScript disabled.
  • Fixed A live accessibility failure: dimmed hint text used opacity, which drops contrast below the WCAG minimum regardless of the color token.

Self-hosted OCR, offline support and the first guides

  • Added Optical character recognition with Tesseract self-hosted — 11MB of WebAssembly served from this site, so English OCR makes no external request at all.
  • Added Long-form guides with reference tables of real figures.
  • Added Offline support through a service worker, and installation as a progressive web app.
  • Fixed The service worker never installed on the live site — it precached root-absolute paths that 404 under a project subpath, so installation failed silently and offline support did not work.
  • Fixed Every event handler was registered twice, which produced two stacked command palettes and delivered pasted files to a tool twice.

First public build

  • Added The catalog, across PDF, image, conversion, text, developer, calculator, unit, color, web and media categories.
  • Added Three themes, a command palette, and paste-or-drop anywhere.
  • Note No analytics, no accounts, no upload endpoint. None of those has been added since, and none is planned.