KitBoxDev is live: 35 in-browser tools, built the way we wanted to use them

Why we built a tool platform with no backend, no accounts and no uploads — and what 35 finished tools, a 12 KB app shell and WCAG-audited contrast actually took.

announcementperformanceaccessibilitydevops

Every developer has the same bookmark folder: a dozen single-purpose sites, half of them wrapped in ad walls, most of them quietly POSTing whatever you paste into a box. KitBoxDev is live today with 35 tools that fix the two things that folder gets wrong — where your data goes, and how long you wait.

Key Takeaways

What shipped The number Why it matters
Tools at launch 35, across three collections 12 developer, 13 electrical, 10 DevOps — each a finished page, not a stub
Data handling Zero bytes transmitted No backend exists to receive them; crypto runs on the browser’s Web Crypto API
App shell ~12 KB gzipped JavaScript Zoneless Angular, one lazy chunk per tool, nothing else on the critical path
Pages 60 prerendered at build time Static HTML first paint; hydration is an upgrade, not a prerequisite
Contrast WCAG 2.1 AA, audited pair by pair Including SC 1.4.11 on control borders, which most sites miss
Cost to you No account, no email, no paywall Open the page, do the thing, close the tab

Why build this at all

The honest answer: because the existing options force a trade you should never have to make.

Paste a production JWT into a random decoder and you have just handed a stranger’s server your token’s claims — issuer, subject, scopes, sometimes an email address. Paste a .env file into an online converter and you have leaked credentials. The tools are genuinely useful, which is exactly why people keep using them anyway, and why “just don’t paste secrets” has never once worked as a policy.

The fix isn’t a privacy promise in a footer. It’s an architecture where the promise is unfalsifiable: there is no server for the tool to reach. Every KitBoxDev tool is client-side code. No backend, no database, no account system, no analytics on your input. You can verify it — open DevTools, watch the Network tab, paste your token. Nothing goes out.

That constraint drove everything else. If the work happens on your device, then the page has to load fast and the interface has to be right the first time, because there’s no server round-trip to blame for the delay and no “sign in to save” screen to hide behind.

What “35 tools” actually means

Not 35 entries in a list. Thirty-five pages that a working engineer can finish a real task on:

Developers — 12 tools. JWT Debugger (decode and verify signatures — HS, RS, PS and ES — locally), Regex Tester, Hash Generator, Base64, URL encoder, JSON formatter, UUID generator, TOTP generator, QR code generator and reader, text encryption, text scrambler.

Electrical — 13 tools. Resistor Color Code, capacitor code decoder, Ohm’s law, voltage divider, LED series resistor, 555 timer, PWM duty cycle, RC/RL filter, PCB trace width, wire gauge and ampacity, battery life, engineering unit converter, and a Logic Gate Simulator.

DevOps — 10 tools. Cron Expression Parser, CIDR / Subnet Calculator, chmod calculator, uptime & SLA budgets, Kubernetes resource converter, YAML ↔ JSON, .env file converter, htpasswd generator, docker run → Compose converter, certificate & CSR decoder.

The bar for shipping each one was the same: does it handle the ugly input? The cron parser explains the expression it just read back to you in English. The docker-to-Compose converter translates every flag it can and lists the ones it couldn’t, with the reason — rather than silently dropping them, which is the failure mode that makes generated Compose files dangerous. The JWT tool distinguishes “this decodes” from “this verifies,” because conflating those two is how backends get compromised.

Fast, specifically

“Fast” is a claim people make about sites that take four seconds to render a text box. Here are the actual build numbers:

  • App shell: 41 KB raw, ~12 KB gzipped. That’s the entire framework runtime, router and layout.
  • Stylesheet: 48 KB raw, ~9.5 KB gzipped — the whole design system, every tool, both themes.
  • 60 pages prerendered to static HTML at build time. outputMode: static, so the first paint is a file off a CDN edge, not a render.
  • One lazy chunk per tool. Opening the CIDR calculator downloads the CIDR calculator. Visiting the site does not download 35 tools’ worth of logic on the chance you might need one.
  • Zoneless change detection. Angular 22 with provideZonelessChangeDetection() and signals throughout — no zone.js patching every async API in the browser, no change-detection sweeps triggered by a setTimeout in an unrelated component.
  • Hydration with event replay. Click a button in the 200 ms before the JavaScript is interactive and the click is replayed, not swallowed.
  • A service worker that registers only once the app is stable, so a repeat visit is instant and an update announces itself instead of ambushing you mid-task.

Build budgets are enforced in CI: the initial bundle errors the build past 450 KB, and any component stylesheet errors past 8 KB. Performance regressions here don’t get discovered in production, they fail the pipeline.

UI/UX: the part that usually gets skipped

A utility site is judged in about three seconds, and most of that judgment is typography and contrast. The design direction is Swiss International Typographic Style — neutral surfaces, Helvetica-lineage type, radii capped at 8px, exactly one accent colour. Deliberately quiet, because the tool output is the content and the chrome shouldn’t compete with it.

Underneath that, the details that take the actual time:

Contrast is audited, not eyeballed. Every ink-on-ground pairing carries a measured ratio in the source: #CC1F14 on white is 5.5:1, and in dark mode #F0463C on #0B0B0C is also 5.5:1. Dark-mode filled buttons use dark ink on red rather than white — because white on that red doesn’t clear AA, and shipping it anyway is how “accessible” sites end up unreadable.

Borders come in three weights, because a divider and a text input are not the same job. Decorative rules are decorative. Interactive edges hold 3:1 against white to satisfy WCAG 2.1 SC 1.4.11 — non-text contrast, which is the criterion almost every “clean minimal” redesign quietly fails.

The command palette is a real combobox. Ctrl/⌘ + K from anywhere. It’s built on the native <dialog> element, so focus trapping, Escape, the inert background and ::backdrop come from the platform instead of from 200 lines of hand-rolled JavaScript that gets it 90% right. Arrow keys move the active row with wrapping, Enter opens it, and aria-activedescendant means focus never actually leaves the input — so screen reader users get the same model sighted users do.

Search that ranks. Tokenized query, every token must match (AND), each token can match any indexed field (OR), ranked by strongest hit: name prefix beats word prefix beats keyword prefix beats substring. Type crypto and you get every tool tagged crypto, not an alphabetical dump.

No theme flash. A pre-paint inline script reads the stored preference before first paint. Dark mode arrives dark, not white-then-dark.

Retired tools still resolve. The JWT decoder and generator were merged into the unified JWT Debugger. Their old URLs still work — they serve a prerendered page carrying the correct canonical, then navigate. A bookmark from six months ago doesn’t 404.

This blog is part of the same deploy

Small thing, but it says something about the approach: this post isn’t on a separate blogging platform. It’s Astro, building straight into the app’s static output directory — same origin, same design tokens, same deploy, no proxy and no second backend. The post’s relatedTools links are validated against the app’s real tool registry at build time, so a post can’t link to a tool that doesn’t exist or call one by a name it no longer has. Link rot fails the build instead of failing your click.

What’s next

Thirty-five is the launch number, not the ceiling. The roadmap is driven by the same question every tool had to answer: is there a task engineers do regularly that currently requires pasting something sensitive into a stranger’s server? Those come first.

Nothing on this site will ever require an account, and nothing you type will ever leave your device. That’s not a plan we intend to revisit — it’s the constraint the whole thing is built on.

Pick a collection and try one: Developers · DevOps · Electrical.