Why the non-AI tools never touch a server
Base64, QR codes, and password generation don't need a network round trip — so we don't make one.
Encoding, QR generation, and password generation all run entirely client-side. There's no technical reason to send a password you're about to use to a server, and no reason to make a QR code wait on a network request when a canvas can draw it in milliseconds.
The tradeoff is that these tools work offline and leave nothing to redact in server logs, because there's nothing sent in the first place. The AI tools — PII detection, entity recognition, translation — genuinely need a model to run against, so those go through our API routes instead.
It's a small distinction, but it's the reason the toolkit is split the way it is: utilities first, AI where it actually earns its keep.