Loading today’s stories
Build1 distinct publisher3 min readPublished
FreeToolHub runs 21 AI tools with no inference server. The mechanism is device accounting: one registry row per model recording backend, dtype, download size, and the memory floor below which it will not run.
The Engineer · Build desk
build
A browser video editor pays for its missing upload button in runtimes, caches and determinism1 distinct publisher
build
Llama-3 in the browser: the record stays put, but you ship 4 GB to every device1 distinct publisher
build
Unsloth's 10% quant claim is really about which machines can run a 27B model1 distinct publisher
build
Browser-native OCR swaps a five-week DPA queue for a 586 MB first load1 distinct publisher
Compiled by The EngineerSomething wrong?How this is made
The 600,000 ms in that registry entry sets a bandwidth eligibility test written as a constant [7]. Divide the WASM build by it. 1,400 MB over 600 seconds is 2.33 MB/s, about 18.7 Mbit/s held for the full ten minutes, or the load never completes [24]. The WebGPU build asks for less: 900 MB in the same window is 1.5 MB/s, roughly 12 Mbit/s [25]. Two backends, two throughput thresholds, both implied by one field nobody reads as a threshold.
That is why the small sibling does more work than the quantization trick. SmolLM2-360M is 200 MB, 4.5 times smaller than the WebGPU build of the 1.7B and 7 times smaller than the WASM build [16][27], and the author reports it handles rewrites, captions and short generation acceptably [16].
The memory field is the other half of the accounting. minMemory for smollm2-1.7b is 2048 with no unit given, but the neighbouring field is downloadSizeMB, so read it as megabytes [6]: subtract the 1,400 MB of q4 weights and the declared device floor leaves 648 MB for the browser, the page and the runtime [26]. Roughly two thirds of the stated requirement is the file itself.
Fan-out is recorded too. The 1.7B entry's usedBy list names three routes plus thirteen more [8], which is 16 of the 21 tools on one model [9]. Cached bytes live in IndexedDB under versioned keys, and bumping a model version invalidates them deliberately [17].
The header choice is COEP: credentialless instead of require-corp. Threading needs SharedArrayBuffer, which needs cross-origin isolation [10]. The textbook route, COEP require-corp, demands that every cross-origin subresource opt in with CORP or CORS, which ad networks, consent-management scripts, analytics beacons and image CDNs do not do, so they fail silently [11]. credentialless keeps the isolation and strips credentials from cross-origin requests instead of blocking them, and no-cors subresources still load [12]. It transfers on one condition: nothing in the pipeline needs a credentialed cross-origin fetch [13]. Theirs does not, because the weights come from HuggingFace and a fallback CDN with no cookies involved [13].
The dependency graph shows the collision plainly. transformers.js pins its own onnxruntime-web, so an app that also imports ORT directly gets two versions in one bundle, fighting over the WASM glue [18]. Their package.json declares onnxruntime-web 1.21.0 and then overrides the nested copy inside @huggingface/transformers to 1.25.1 [19]. Two runtimes on purpose, because the npm version and the shipped binary are only loosely coupled, and every loader that fetches .wasm at runtime is another chance to mix them [20].
One claim here does not travel. The line about leaving a third of your users behind by shipping a single quantization is a statement about FreeToolHub's own backend split [15]. To reuse the rule you need your own WebGPU share measured; if 95 percent of your traffic has WebGPU, the second quantization is a 1.4 GB artifact maintained for a rounding error. And the piece opens by promising the tool it had to kill [22], then stops at the background-removal CDN change without naming the tool or the configuration that failed [23]. A pity, because the config that fit nothing would have been the most useful row in the registry.
Ranked by verification strength, evidence, and original report placement.
The write-up says up front that it is the honest version of a year of WebML sharp edges, 'including the tool we had to kill'.
The published text available ends at the @imgly/background-removal CDN-side artifact change and never identifies the killed tool or the configuration that failed.
FreeToolHub ships 21 AI-powered tools with no backend, no API keys, no upload endpoint and no inference server; the model downloads to the browser and runs there, so text and files never leave the device.
The tools include email and report writers, resume rewriters, background removal, image upscaling, audio transcription, LaTeX OCR, translation and contract analysis.
The stack is @huggingface/transformers (transformers.js) 4.2.0 on top of onnxruntime-web, using WebGPU where available with WASM as the fallback, and the same model can ship two quantizations for the two backends.
One TypeScript registry is the single source of truth for all 18 models, recording HF repo, dtype, backend, download size, minimum device memory and which tools use the model; if a model ID appears anywhere else, the team treats it as a bug.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 5, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Checkable config, single author
The registry excerpt and the package.json block are the strongest things in this story: version numbers, header names, dtypes and byte counts a reader can paste into a build and verify. Around them sits judgement from one year of one person's shipping — that 360M 'handles rewrites fine', that a single size per model abandons a third of users — with no benchmark, no telemetry and no second voice. dev.to publishes it as written, so nothing was independently checked before it went out.
One live site, self-disclosed
Twenty-one tools are described as live and one as withdrawn, both by the person who built them. There is no traffic figure, no share of visitors who finish a 900 MB download, no outside confirmation that the site behaves as described, and no sign of anyone else adopting the credentialless-plus-vendored-WASM pattern. The deployment is real in shape and unmeasured in scale.
More caveats than pitch
The post talks its own product down. The 1.7B class is called a drafting assistant rather than a GPT-class one, and the section naming the killed presentation generator is exactly the section most launch write-ups would cut. Two numbers lean the other way and neither is backed: the third of users supposedly lost by shipping one quantization, and the 16-of-21 count read off a code comment. On balance it under-sells what it has.
The author owns the product
Privacy is the pitch, as the post says outright, and the pitch is for a site the author ships. The revealing passage is the header one: require-corp breaking ad networks, consent scripts and analytics beacons is described as hitting the business model, which places FreeToolHub's own revenue on the third-party scripts the architecture then had to accommodate. That does not make the credentialless advice wrong, but it does explain which trade-off was available to be chosen.
Mechanics credible, scale unknown
Header values, package versions and dtype names are hard to fake and easy for a reader to test, so the engineering account holds up well. What the story cannot establish is whether 900 MB downloads actually complete for real visitors, how the 2,048 memory floor was arrived at, or whether that figure is even megabytes — the field carries no unit while its sibling is named downloadSizeMB.