Most online PDF tools upload your documents to someone's server. That's a genuine problem for anything containing a contract, a payslip or an ID. The same tools can run entirely in the browser, and "your files never leave your device" is a real, honest selling point.

1. Everything client-side

The whole design commitment. No server, no upload, no storage. A library that manipulates PDFs in the browser does the work; the file is read into memory, changed, and offered back as a download.

This also means static hosting, zero running costs, and no data-protection obligations.

pdf-tool-build.txt
Build a browser-only PDF tool. No server, no upload — files must never
leave the device. Say which library you're using and confirm it works
fully client-side.

Operations: merge several PDFs, split by page range, rotate pages,
delete pages, reorder pages.

Interface:
- Drag and drop files, plus a normal file picker for accessibility.
- Page thumbnails, reorderable by drag and by keyboard.
- Progress for large files, and it must not freeze the tab — use a
  worker if needed.
- Download the result with a sensible generated filename.

State clearly on the page that processing is local.

2. Handle the awkward files

Real PDFs are messy. Encrypted ones you can't open without a password. Corrupt ones. Enormous ones that exhaust memory. Files that aren't PDFs at all despite the extension.

Each needs a clear, specific message. "Something went wrong" on a 300-page document someone waited two minutes for is a bad experience.

3. Don't freeze the tab

A large PDF processed on the main thread locks the interface completely — no progress, no cancel, and browsers may offer to kill the page. Move the work to a Web Worker and report progress back.

4. Prove the privacy claim

Since it's your main differentiator, make it checkable: state it plainly, and mention that the network tab will show no upload. People who care about this will look, and being right is a strong position.

Test with a 200-page scanned document. Everything works on a three-page invoice; memory limits and freezes only show up at real sizes.