I built 150 dev tools nobody asked for. Google sent me 6 clicks.

Description and use

Built 150 browser‑only tools with privacy verified by tests and CSP, achieving modest search traffic.

Developers often use online tools that upload sensitive data to third‑party servers, exposing privacy risks.

The site hosts 150+ tools that run fully client‑side, with privacy verified by tests and CSP, achieving 20.8K impressions and 6 Google clicks.

1. Build a Next.js 15 static export with output:'export'.
2. Maintain a single registry file (lib/tools.ts) listing all tools.
3. Lazy‑load each tool as a separate chunk via dynamic(import()).
4. Keep shared JS under 105 KB and load heavy libs only inside click handlers.
5. Enforce privacy with Vitest scans for network/storage calls, Playwright canary tests, and CSP headers.
6. Test each tool’s functionality with Vitest and Playwright, including image format checks and QR decoding.

If the tool can run in the browser, it runs in the browser. If it can’t, it doesn’t ship.

Shared first-load JS stays around 105 KB, and it only grows about 1 KB per dozen new registry entries.

A canary string goes into every tool, and the test fails if it shows up in any network request, URL, page title, storage or console.

After every build I check the output to make sure those libs show up as their own per-tool chunks and not in the shared bundle.