Utilities¶
The articles on this site explain how to protect yourself. This section holds the tools you can use directly. Four rules apply to all of them:
- Everything is computed in your browser, and nothing is sent anywhere
- Once stored on your device they work with the network off, and working offline is itself the proof that nothing is being sent
- The source is in anoni-net/docs, so anyone who can read code can verify it
- All of them need JavaScript enabled, because the computation happens on your device
One conflict to know about if you use Tor Browser¶
Setting Tor Browser's security level to Safest disables JavaScript entirely, and the tools in this section stop responding.
The conflict is that the same page's guidance is to raise the level for "unfamiliar onion sites, links of unknown origin, unfamiliar domains", and receiving a suspicious link is exactly when you would want the invisible character detector or the QR code reader.
Handle the two separately. Open the suspicious site at the higher level, copy out the text or image you want to check, switch back to Standard to examine it, then raise the level again. The tools here make no outbound connections, so opening them at Standard does not add to your exposure on that site.
Available now¶
-
Turn your answers to the three questions (what you are protecting, who from, what you will spend) into a copyable checklist, with the mismatches flagged. Nothing is saved, and reloading clears it.
-
Passphrase and password generator
Draw a passphrase from the 7776-word asian-diceware list, or a random password from the character sets you pick. Randomness comes from the browser's
crypto.getRandomValues, and the tool tells you how much entropy you got. -
Turn onion addresses, Tor bridges and other long, easily mistyped strings into a QR code the person in front of you can read with a camera, without anything passing through a server. Downloadable as SVG for printing.
-
Read what is inside a QR code image without the image leaving your device. URLs get their hostname shown separately, and there is no open button.
-
Strip EXIF, GPS, device model, authoring software and comment fields from photos, videos and PDFs without the file leaving your device. For photos and videos not one byte of compressed data is touched, and every segment kept or removed is listed for you.
-
Pick out and remove the tracking parameters in a URL, each annotated with who is doing the tracking. Unwraps Google and Facebook redirect wrappers too.
-
Find zero-width characters, bidirectional controls and homoglyphs hiding in text, with positions marked and each class explained. Both document leak tracking and phishing URLs rely on these.
-
Lists what any site can read without asking, annotated with how Tor Browser normalises each one. Open it in a second browser to see what those defences actually do.
Taking them offline¶
The code and data behind these tools are stored along with the page. Tick this section in the offline reading list and the pages will open without a network afterwards.
Whose code this uses¶
Most of the code in this section is our own, under anoni-net/docs. Four things come from elsewhere, included unmodified:
| Component | Used by | Licence | Where the licence text is |
|---|---|---|---|
| qrcode-generator 1.4.4 | QR code generator | MIT | the header at the top of the file |
| jsQR 1.4.0 | QR code reader | Apache-2.0 | jsQR-LICENSE.txt |
| pdf-lib 1.17.1 | The PDF part of the file metadata remover | MIT | pdf-lib-LICENSE.txt |
| The 7776-word list from asian-diceware | Passphrase and password generator | Word data CC-BY-4.0, code MIT | the upstream repository |
The pdf-lib.min.js build also bundles Microsoft's tslib (Apache-2.0), whose copyright header survives in the file rather than being stripped by the minifier.
Leaving these unmodified is deliberate. Editing them would forfeit their upstream provenance, leaving readers who want to check with nothing but our word for it. The files sit under utils/vendor/ and can be diffed against upstream.
Why each of these is not written from scratch is explained at the bottom of the relevant page. The shared reason is that getting them wrong does not crash anything. It produces output that looks right and is not, which is harder to notice than a failure, and the QR code generator page records one such case we hit ourselves.
What is not here¶
Anything that needs an external service to work stays out, because the connection itself breaks both the offline rule and the no-data rule. For network measurement use OONI Probe, which is built for network measurement and documents what happens to the data.