Every file you touch here stays on your machine.
PDF, image, developer, SEO, text, student and business tools — all free, all entirely in your browser. No upload, no account, no server ever sees your data.
The toolset
Focused tools covering the everyday PDF work — pick one to get started, no account needed.
How this actually works
Each tool runs entirely with JavaScript already loaded in this page — PDF tools via pdf-lib and pdf.js, image tools via the browser's native Canvas API, and everything else with plain JavaScript. Your files or input are read into browser memory, processed, and handed back as a download or copyable result. This page itself is served by a small Laravel route; Laravel never sees your files either. The only backend in use is Supabase, and only for two optional things: signing in with a magic link, and — only if you're signed in — a log of which tool you ran and when. Two things have real limits worth knowing up front: Compress PDF flattens each page to a re-encoded image (great for scan-heavy PDFs, not ideal if you need selectable text after), and Word/Excel/PowerPoint ⇄ PDF conversion genuinely requires a server-side rendering engine, so it isn't included here — this build only ships tools that can honestly run client-side.
Questions people actually ask
Which JWT signing algorithms can it verify?
HMAC-based algorithms only — HS256, HS384, and HS512 — since those use a shared secret this tool can actually check against.
Can it verify RS256 or ES256 tokens?
No — those use asymmetric key pairs (a private key signs, a public key verifies), not a shared secret. Verifying them would need the issuer's public key in a different format than a simple secret string, which this tool doesn't handle.
What's the difference from JWT Decoder?
JWT Decoder reads the header and payload without checking the signature at all — useful when you just want to inspect a token's contents. This tool actually verifies the signature is valid for the secret you provide, confirming the token wasn't tampered with or forged.
What's the difference from JWT Encoder?
JWT Encoder creates and signs a new token from a header and payload you write. This tool checks an existing token's signature — the reverse operation.
Does it check if the token is expired?
Yes — if the payload has a standard "exp" claim, it reports whether the token has expired, alongside the signature verification result.
Is my secret sent anywhere?
No — verification uses the Web Crypto API entirely in your browser; the token and secret are never transmitted.
What if the signature is invalid?
The tool clearly reports an invalid signature — it still decodes and shows the header and payload contents, since inspecting a tampered or mismatched token is often exactly why you're checking it.
Can I use this to debug an authentication issue in my own app?
Yes — a common real use is confirming that a token your server issued (or received) actually verifies against the secret your app is configured with, without needing to add logging or a debugger to the server itself.
Is this really free, and is there a file size limit?
Yes — no account, no paywall. Since processing happens in your browser's memory rather than uploading anywhere, the practical limit is your device's available RAM, not a server quota. Very large files (500+ pages) may run slower, especially for Compress and PDF→JPG.
Does anything about my file get sent anywhere?
No. Every tool runs with pdf-lib/pdf.js loaded in this page; your file is read into browser memory and never leaves it. The only network call this app makes for your account is Supabase auth — and that only stores which tool you ran and when, never file content.
Why isn't Word/Excel/PowerPoint → PDF included?
Converting Office formats accurately needs a real rendering engine (what Word or LibreOffice use internally) — no browser library does this reliably. Rather than ship a broken version, it's left out.
Does TechDriven Tools have OCR (text recognition)?
Yes — OCR PDF recognizes text in scanned or photographed pages using Tesseract.js, running entirely on your device, and gives you a searchable PDF or a plain text file. Nothing is uploaded for this either.
Can I use this without an internet connection?
Once the page and its libraries have loaded once, yes — the tools themselves need no network access. Signing in and viewing history do require a connection, since those talk to Supabase.
What happens to the "history" if I sign in?
Only a row per tool run — the tool's name and a timestamp. No filename, no file content, ever. You can see the full list any time via the History button.
Are the non-PDF utilities (password generator, JSON formatter, etc.) private too?
Yes — same rule as the PDF tools. Word Counter, Case Converter, Password Generator, UUID Generator, Base64, Hash Generator, JSON Formatter and JWT Decoder all run with plain JavaScript already loaded in this page; nothing you type or paste is sent anywhere.
JWT Verifier, in depth
Verify an HMAC-signed JWT's signature against a shared secret, and check whether it's expired.
Features
HS256/384/512
Supports every standard HMAC-based JWT signing algorithm.
Real Signature Check
Uses the Web Crypto API to actually verify, not just decode.
Expiry Check
Flags whether a standard "exp" claim has passed.
Private
The token and secret never leave your browser.
Why use JWT Verifier
- Confirm a token your server issued actually verifies against the secret it's configured with.
- Debug an authentication issue without adding logging to your server.
- Check that a token wasn't tampered with before trusting its contents.
- Confirm a token has genuinely expired rather than guessing from its issued time.
How it works
The token's header and payload are decoded, then the browser's native Web Crypto API re-computes the HMAC signature over the token using the secret you provide and compares it to the token's actual signature — a real cryptographic verification, not just a decode. If the payload has a standard "exp" claim, that's checked against the current time too.
Why RS256/ES256 tokens aren't supported
Those algorithms use an asymmetric key pair — a private key signs, and a different public key verifies — rather than one shared secret both sides know. Verifying them needs the issuer's public key in a specific format, not a plain secret string, which is a meaningfully different input this tool doesn't currently accept. For HMAC-signed tokens (the common case for tokens an app both issues and verifies itself), this tool works as intended.