Documentation

How the platform is built, what runs where, and how to extend or self-host it.

Getting started

Pick a tool, drop a file, read the preview, download. No account needed for anything except the AI tools.

How local processing works

Files are read with the File API, parsed in a worker, transformed in memory and written back as a Blob. No network involved.

Read the architecture

API reference

Every endpoint, with request and response shapes, error codes and rate limits.

Open the reference

Authentication

Session cookies for the app, bearer API keys for machines. Rotation, 2FA and revocation explained.

Auth endpoints

Security model

What we do and do not hold, the controls in place, and how to report a vulnerability.

Security page

Guides

Longer-form writing on formulas, data quality, performance and privacy.

Read the blog

Architecture

The application is two deployables plus a database.

Web (Next.js 15, React 19). Statically renders every marketing, tool and blog page at build time. Tool pages ship a small client island — the runner — and nothing else interactive. The tool engines are code-split per engine, so opening the CSV converter never downloads the PDF extractor.

API (Node.js, Express). Handles authentication, billing, the AI proxy, the admin surface and the server-side conversion endpoints. Stateless, so it scales horizontally behind PM2 or a load balancer.

Data (MySQL via Prisma, Redis). MySQL holds accounts, subscriptions, API keys, blog content and audit logs. Redis holds sessions, rate-limit counters and short-lived caches.

The tool engine

Every tool is a thin wrapper around an *engine* — a pure function with the signature:

(input: EngineInput) => Promise<EngineResult>

EngineInput carries the files, the resolved options, the preset declared on the tool definition, and a progress callback. EngineResult carries downloadable artifacts, headline statistics, an optional tabular preview, optional text output and warnings.

The registry in src/lib/engines/index.ts is typed as a total map over EngineId. Adding a tool whose engine has no implementation is a compile error rather than a runtime surprise.

This separation is why 66 tools share one runner UI: the runner renders whatever fields the engine declares and displays whatever result it returns. It knows nothing about spreadsheets.

File format support

Reading: XLSX, XLSM, XLSB, XLS, ODS, CSV, TSV, JSON, JSONL, XML and HTML tables.

Writing: XLSX, CSV, TSV, JSON, XML, HTML and print-ready PDF.

Encrypted workbooks cannot be read. That is a property of encryption, not a limitation we can lift — remove the password in Excel first.

What runs on a server, and why

Three things, all labelled in the UI:

AI tools — the model runs on Anthropic's infrastructure. We send a schema and up to five sample rows, never the file.
The API — by definition, since the caller is a server.
Account features — sign-in, saved settings, billing.

Everything else runs on your device. If our API is down, the converters keep working.

Self-hosting

The repository ships with a Docker Compose stack (web, api, MySQL, Redis, Nginx) and a PM2 ecosystem file for a bare VPS. See docs/DEPLOYMENT.md for the Hostinger walkthrough, including SSL, reverse proxy configuration and zero-downtime reloads.