Offline developer toolboxOffline developer toolbox

Overview

Every developer has a folder of bookmarks for decoding a token, formatting a query, diffing two blobs of JSON. Most of those sites upload what you paste. This one does not have a server to upload to: everything runs in the tab, which means it also works on a plane and can be installed like an app.

It grew past the utilities. There are cheat sheets with interactive diagrams, quizzes, and a practice section that runs real code and grades the result.

The part that was interesting to build

Running a stranger's code safely, without a sandbox server. The practice section executes whatever the user writes — JavaScript, SQL, Python. The containment is not done by deleting globals, which is porous: dynamic import is syntax, not a function you can delete. It is done at the HTTP layer. A web worker inherits its policy from the response that served its script, so each worker ships with its own content-security policy. The JavaScript grader is served with a policy that permits evaluation but names no host anywhere, so fetch, sockets and dynamic import are all refused by the platform itself rather than by code that can be worked around. The SQL and Python workers get exactly the additions their runtimes need to load their own WebAssembly, and nothing more. Runaway loops are handled separately, by terminating the worker on a timeout.

Shape of the system

One application, no backend, no database, no API routes. Every tool and cheat sheet is prerendered in both languages at build time, so the site is static and the interactivity is entirely client-side. The heavy lifting — a Python runtime, a SQLite engine, PDF and cryptography libraries — is WebAssembly staged into the build.

Scale

• 109 tools · 47 cheat sheets · 9 exercises · 6 quizzes · 4 recipes
• Two languages · around 480 unit tests plus end-to-end coverage
• Zero servers to run and nothing to leak