Security
Passwords, keys and the random material everything else is built on.
Small tools,
properly made.
Bench is a set of single-purpose utilities for the jobs that turn up between real work — a password to generate, a photo to shrink, a colour to check, two files to compare. Every one of them is a page with one job on it. Open it, use it, close the tab.
- No account
- No uploads
- Works offline
Generated password
Fortress
~121 bits · 10²⁶ years to crack
24 characters
A–Z a–z 0–9 symbols
Look-alikes skipped
Categories
Every tool has a home
A password generator and a favicon maker have nothing to do with each other, so they don't share a drawer. Each shelf below says what belongs on it, and every tool carries its own mark — so you can find the one you want before you have read a word of the labels.
Images
Everything you do to a picture before it goes on a page.
Colour
Picking, checking and shipping colour that survives a design review.
Data
Turning one structured format into another without losing anything.
Text
The edits and counts you do to words before anyone else reads them.
A good tool does one thing, does it the moment you open it, and then gets out of the way.
On the bench
A closer look at a few
What you see below is the interface itself, not a screenshot of one. Every tool is a full page with its own settings, its own output and nothing else on it.
Security
Password Generator
Random passwords drawn with rejection sampling, so there's no modulo bias anywhere in the output. Watch the entropy count climb as you push the length slider, and see a realistic crack-time estimate update alongside it.
k7#Rv2mQ!pLz9Wt@fHn4Xc$bJ
Open tool
Images
Image Compressor
Re-encode photos to JPEG, WebP or PNG at a quality you choose, then drag the divider to compare the two side by side before you keep either.
Open tool
Colour
Colour Studio
One colour, read back as HEX, RGB, HSL and OKLCH at the same time — or picked straight off the screen when the colour you want is already in front of you.
#FF6B35
oklch(0.71 0.19 42)
Data
JSON Formatter
Beautify, minify or sort the keys — and when something is wrong it names the line and the column, rather than telling you the file is invalid and stopping there.
{
"build": 42,
"pass": true
}
"build": 42,
"pass": true
}
Valid · 2 keys · 0 problems
Anatomy
Every tool page is the same page
Open any of them and you will find the same three parts in the same three places. That is on purpose: once you have learned one page you have learned all of them, and there is nothing to set up before the tool will do anything.
01
The head
The name of the tool, and a trail back to the shelf it came off. Nothing sits above it but the site header, and there is nothing to dismiss, accept or sign before the tool will work.
02
The settings
Whatever that tool needs to know first — a length, a quality, a format, a delimiter. They run down the left in the same order every time, so the third visit is quicker than the first.
03
The output
The result, with copy and download within reach of it. It appears as soon as there is something to show and follows the settings as you change them, rather than waiting to be asked.
Most of these pages carry one more panel, usually last and usually short — "Good practice", "Counting rules", "Where the rules run out". It names the point at which that particular tool stops being reliable. It is the shortest panel on the page, the one most worth reading before you trust an output, and the one most people scroll straight past.
In practice
Whole jobs, start to finish
Nobody arrives wanting a tool. They arrive with a job that happens to need one, and usually more than one, in an order that matters. These are the runs that come up most, written out step by step.
A photo that has to go on a page
Straight off a phone, the picture is around 4 MB and 2400 pixels wide. The page needs neither of those numbers, and the two get fixed in a particular order.
A brand colour that fails contrast
The colour is fine as a logo and unusable as body text. The hue was given to you and is not yours to change, which leaves one axis to move along.
A config file that has to survive the trip
Something in the file is wrong and you are not sure what, and it has to end up somewhere that mangles quotes and strips newlines.
Limits
Where each tool stops
A tool that claims to have no edges is lying to you. These are the edges — the point past which each of these stops being worth trusting, and what to reach for instead.
- Base64 Encoder
- Base64 is not encryption. Anyone holding the output can decode it in a single line and no key is involved at any point. What it does is carry binary through a channel that only accepts text, without mangling it on the way. Treat the output as readable, because that is what it is.
- Hash Generator
- A checksum, not a password store. MD5 and SHA-1 are broken for collisions, which means two different inputs can produce the same digest, so treat them as fingerprints rather than guarantees. Storing passwords properly needs a deliberately slow function, and a page that has to answer instantly is the wrong place to run one.
- Password Generator
- The entropy figure assumes the attacker knows the recipe and not the result. That is arithmetic, not a promise: it describes how large the search space is, not how well the password was kept afterwards. A password typed into a machine you do not control is already out of your hands, and no amount of length fixes that.
- Image Compressor
- Lossy means gone. Every re-encode of a JPEG costs a little quality and there is no setting that gets it back, so compressing the same photo again for each new size is how a picture ends up looking fine on your screen and muddy on someone else's. Keep the original until the compressed copy has actually shipped.
- Favicon Generator
- The browser has the last word. 32×32 is a convention rather than a rule, browsers will scale whatever you hand them, and single-pixel line work turns to mush at the small sizes however clean the source file was. Draw the icon for the size it will be seen at, not the size you happen to be working at.
- Word Counter
- It depends entirely on who is counting. This one counts whitespace-separated tokens; a word processor counts differently and will disagree with it on hyphenated words, on numbers and on anything with an apostrophe in it. Text that puts no spaces between words has no tokens to count at all, which is a long-running disagreement rather than a bug in either tool.
- Contrast Checker
- A computed ratio, not a perceived one. The maths runs on the hex values you give it, so the same pair of colours scores identically on a calibrated monitor and on a laptop at low brightness in a bright room. The number is the part that travels; what you see on your own screen is not.
- JSON Formatter
- Sorting the keys changes the file. Reordering them is a convenience for people reading it, and the meaning survives — but the bytes do not. If that JSON is signed, hashed or compared against another copy, a sorted version will not match, and the tool will not warn you because from its side nothing went wrong.
- URL Encoder
- Percent-encoding is not one rule. A space becomes a plus sign in a query string and %20 in a path, and several characters are safe in one position and not in the other. Encoding for the wrong position gives you a link that works — right up until it meets a server that is stricter than the one you tested against.
The longer version of all of this — the licences, the warranty and where the advice stops — is on the disclaimer page.
Choosing
Picking between lookalikes
A good share of the questions that arrive are really about which of a pair to open. These are the ones that get mixed up, and the question that separates them.
Compressor or resizer?
Image Compressor
Keeps the width and height, and discards detail to get there.
Image Resizer
Changes the width and height, and keeps the detail it has.
Too many bytes for the connection, compress. Too many pixels for the layout, resize. Running them the wrong way round costs quality you cannot get back.
Hash or UUID?
Hash Generator
The same input gives the same string, every time, everywhere.
UUID Generator
A different string every time, with nothing to derive it from.
Use a hash to check whether something has changed. Use a UUID to name something that has no name yet and is not going to get one.
Base64 or URL encoding?
Base64 Encoder
Carries binary through a channel that only accepts text.
URL Encoder
Carries text through a query string without it falling apart.
The wrong one does not fail loudly. It just makes the output longer and uglier, and wrong in a way that only shows up later.
Passphrase or password?
Passphrase Generator
Real words in a row. Long, and typeable from memory.
Password Generator
Random characters. Short, and you will not remember it.
A phrase of five words usually carries more entropy than eight characters of symbol soup, and you stand a chance of typing it without the clipboard.
Reference
What goes in, and what comes out
The image tools will read anything your browser can decode, and write back only the formats every browser can encode. That asymmetry catches people out at the worst possible moment, so here it is before you need it.
| Format | Comes in | Goes out |
|---|---|---|
| JPEG | Yes | Yes |
| PNG | Yes | Yes |
| WebP | Yes | Yes |
| AVIF | Yes | Written out as JPEG, PNG or WebP |
| GIF | First frame only | Written out as JPEG, PNG or WebP |
| SVG | If it carries a width and a height | Written out as JPEG, PNG or WebP |
Transparency follows the same rule, and it is the one that bites. A transparent PNG keeps its transparency in PNG and in WebP, and loses it the moment you ask for JPEG. An animated GIF loses its frames as soon as it is drawn to a canvas, because a canvas holds one frame and nothing else.
How it's built
Built like a tool, not a funnel
-
One page, one job
There is no dashboard here, no workspace and no project to set up first. Each tool is a single page that does the thing you came for and then forgets you were there.
-
Fast because there's less
No framework, no bundler, no analytics script, no chat widget. The whole site is hand-written HTML, CSS and vanilla JavaScript, so pages paint on the first frame.
-
Nothing to sign into
No account, no email, no cookie banner and no "continue with" button. The only thing Bench ever stores is whether you prefer light or dark, and that lives in your own browser's local storage.
Under the hood
Built in the open, checked before it ships
There is no framework here, no bundler and no build server. The pages are hand-written HTML, CSS and vanilla JavaScript, and they are assembled by a handful of small node scripts. Adding a tool to the catalogue updates the ticker, the shelves, the navigation and the search in one pass, which means a menu cannot be updated on one page and missed on another.
Before anything ships, two checkers walk the whole site. One follows every internal link, every icon reference and every CSS class on every page, and fails on anything pointing at something that is not there. The other reads the visible text and fails on marketing vocabulary, on headings that count the site's own contents back at you, and on exclamation marks.
Neither of them is clever. They are only strict, and the build stops when they complain — which is most of the reason the writing on this page reads the way it does. You can check the claim yourself by opening the page source: what you see is what was written, with no script rewriting the words after the fact.
$ node _tools/build-all.js
homeindex.html
pagesabout · contact · privacy · disclaimer
shellsthe chrome around every tool page
iconsthe sprite, injected last
verify.js0 problems
voice-check.js0 findings
Opens from any page, and closes on Esc.
Everything on the bench is two keys away
The palette is a search box over the whole site — tool names, categories and the one-line description of each. Type "shrink", "sha", "comma" or "french" and it narrows as you go; the arrow keys move, and Enter opens what is highlighted. It is the quickest way across the bench, and it behaves identically on every page.
Missing
What is not on the bench yet
The gaps are as worth knowing about as the tools. Some of these are coming, some are waiting on a decision, and a couple are things I have decided not to build at all.
Audio and video — the browser decodes both happily, but trimming and re-encoding them properly is a far larger job than anything here, and a half-finished version would be worse than having none.
Markdown — a preview needs a parser and a sanitiser, and the sanitiser is the part that fails quietly. Not until that part is right.
Unit and timezone conversion — timezones need a rules database that changes several times a year, and a static page carrying one would eventually start lying to you.
An image upscaler — every one of them invents pixels. That is a real technique, but it is a guess dressed up as a restoration, and it does not belong beside tools that only rearrange what you handed them.
PDF, mostly — merging and splitting are easy. Everything people actually want from a PDF tool is not, and the request is almost always for the hard part.
A saved history — it would need an account, and an account would undo most of what this site is for.
If one of these is what you came for, say so on the contact page — the order things get built in is mostly decided by what people ask for.
Questions
The short answers
Do my files or passwords leave my device?
No. There is no server component to Bench at all. Images are read through the File API and drawn to a canvas on your machine; passwords are generated with crypto.getRandomValues() in the page. Open DevTools, switch to the Network tab, and you can watch that nothing is ever sent.
Why did my compressed image come out bigger?
Because it had already been compressed once. Re-encoding a JPEG at a high quality setting can add bytes instead of removing them: the first pass already discarded what it was going to discard, and the second pass spends bits describing the artefacts the first one left behind. The other trap is a PNG that started life as a photograph — it is carrying detail that lossless compression cannot shrink, and saving it again at a lower colour depth can round the colours up into a larger palette. The Image Compressor shows both sizes side by side before you keep anything, so the number is there to look at rather than to trust.
Does it work offline?
Once a page has loaded, yes — every tool is self-contained. Save a page to your machine and open it from disk and it still works, web fonts aside. There are no API calls waiting to time out.
Is there a file size limit?
Only whatever your browser can hold in memory. The image tools comfortably handle phone photos and full-page screenshots; truly enormous files are limited by your device's RAM rather than by us.
Are the tools free, and what pays for them?
Free, and nothing on the bench asks you to sign up for anything. What pays for the site is advertising, served through Google, which is why the pages carry ads and why the privacy policy has a section about cookies. The advertising code lives in the page shell rather than in the tools: it has no access to the text you paste into a converter or to a file you drop onto one, because the tool never hands anything to the page around it. If you would rather not see ads, blocking third-party scripts will not break a single tool here — each one is self-contained and does not call out to anything.
Does the word counter match Microsoft Word?
Not exactly, and the difference is worth knowing before you write to a limit. Word treats a hyphenated compound as one word; a counter that splits on whitespace agrees, but one that splits on punctuation does not. A figure like 1,200 is one word in Word and two in a counter that treats the comma as a separator. An em dash with spaces around it is its own word in some tools and not in others. None of that matters until a submission caps you at 500 words, and then a piece Word scores at 498 can score at 511 somewhere else. The Word Counter states its own definition on the page rather than leaving you to infer it.
Which browsers work best?
Any current Chrome, Edge, Firefox or Safari. WebP export needs a reasonably modern browser, and the image tools quietly hide that option if yours can't encode it. The interface follows your system light or dark theme out of the box.
Can I use what I make here commercially?
Yes. Nothing produced on this bench carries a watermark, and there is no licence claim over the output. Whatever you make is yours to sell, publish or hand to a client, and the tool will not ask you to credit it.
Why is there no history of what I made?
Because a history needs an account, an account needs a database behind it, and both of those are things this site is deliberately built not to have. If you want to come back to something, bookmark the tool page itself.
How do I report a bug, or ask for a tool that isn't here?
Send it to the address on the contact page. The bug reports that get fixed fastest name the browser and its version, what you did and what you expected instead — and where a setting was involved, the settings rather than the secret. Requests are read the same way. A tool that can be one page with no account and nothing running behind it has a real chance of getting built; one that needs a database does not.
From the blog
The questions the tools raise
Every article takes one of them and answers it properly — the arithmetic shown rather than summarised, and the tool that does the job at the end of it.
What a UUID is, and which version you actually want
128 bits, five fields, 32 hex digits, and a version nibble that decides how much of it is random.
Read it
Verifying a download without trusting the page you got it from
A checksum proves your file arrived byte-for-byte intact.
Read it
What password strength meters actually measure
Every meter on the web is estimating the same quantity, and most of them estimate it badly.
Read it
Start with any tool.
Nothing to sign up for, nothing to install and no watermark on the way out. Pick a category and get on with it.