Open Source Browser Tools: No Account, No Hidden Tracking

Every few months, a popular tool that used to work without an account quietly adds a login wall. Postman did it. Figma tightened its free tier. Notion started blocking exports. The pattern is consistent: tools get funding, growth targets appear, and suddenly “free” means “free with an account we can market to.”

Open source browser tools break this cycle structurally. Not as a policy, not as a promise — structurally. When the code is public and runs in your browser, there’s nothing to log in to, no server-side session to create, and no business model that requires knowing who you are.

The distinction matters. A proprietary tool that skips signup today can add one tomorrow. An open source tool where encryption happens in JavaScript you can read cannot quietly start logging your keystrokes without someone noticing.

Why Open Source and No-Login Go Together

The login requirement almost always serves a business purpose. Account creation enables email marketing. Session tracking enables behavioral analytics. Saved user data enables upselling premium tiers. None of these apply to a client-side open source tool.

When computation happens in your browser — your CPU, your memory, your storage — the developer’s server never sees your data. There’s nothing to protect with authentication because there’s nothing server-side to protect. This is why projects like Excalidraw (90,000+ GitHub stars) can let you draw diagrams indefinitely without knowing who you are. The architecture makes the login unnecessary, not just absent.

“The server doesn’t need to know what you’re working on if the work happens in the browser.”

Open source licensing adds a second layer. When the code is MIT or Apache 2.0 licensed and publicly hosted, any hidden data collection would be visible in the commit history. Projects that tried to add telemetry covertly have been caught and forked. The community enforcement mechanism doesn’t require trusting the company; it requires only that someone reads the code.

For Designers: Diagrams and Image Editing Without Signing Up

When you need to sketch a system architecture, wireframe a UI layout, or create a quick diagram without waiting for a Figma invite to land, Excalidraw opens instantly with no gate. It’s a virtual whiteboard that deliberately looks hand-drawn. Share a collaboration link and a second person joins the same canvas — no account required on either end.

Unlike Miro, which restricts the free tier to three boards before pushing paid plans, Excalidraw imposes no board limits. The source code is publicly available on GitHub under MIT license. You can self-host it. You can audit what happens to the collaboration data. The default hosted version at excalidraw.com uses end-to-end encrypted room links — your drawing content doesn’t pass through their servers in readable form.

For heavier image editing — opening Photoshop PSD files, working with layers, handling complex selections — Photopea handles professional-grade tasks in the browser without registration. It’s not open source, but it’s free and no-login, and it supports formats most online editors can’t: PSD, XCF, Sketch, AI. Open a PSD file from your desktop and you’re editing within a few seconds. No onboarding sequence, no “tell us about yourself.”

For Developers: API Testing and Data Transformation Without an Account

Hoppscotch does what Postman does, before Postman required login for basic API testing. It’s a full API development environment — REST, GraphQL, WebSocket, SSE — that runs in the browser. The project is open source under MIT license and the entire request/response cycle is handled client-side. Your API keys, endpoints, and request bodies don’t transit Hoppscotch’s servers.

The comparison with Postman is instructive. Postman’s January 2023 announcement that the Scratch Pad (offline mode) would be deprecated pushed many developers to look for alternatives. Hoppscotch absorbed a significant portion of that traffic because it was already doing everything without requiring an account.

CyberChef, developed and maintained by GCHQ (the UK’s signals intelligence agency), is the tool security researchers and developers use when they need to encode, decode, hash, compress, encrypt, or transform data without installing anything. It calls itself “The Cyber Swiss Army Knife.” The tool runs entirely in your browser and the code is open source on GitHub.

A basic operation looks like this:

Input:  SGVsbG8sIFdvcmxkIQ==
Recipe: From Base64
Output: Hello, World!

CyberChef supports 300+ operations chained together. No account needed for any of them. Because the code is public and the tool is client-side, you can verify that your input data stays in your browser.

For Privacy: File Encryption and Transfer You Can Audit

hat.sh is a file encryption tool built specifically around the constraint that it should be impossible for the server to see your files. Encryption happens client-side before any network request. You choose a key, the file is encrypted in your browser, and only the encrypted output gets handled further. The source code is on GitHub — you can read the encryption implementation yourself.

This matters because “we can’t see your files” is a common claim from cloud storage and file transfer services. With hat.sh, that claim is technically verifiable. The encryption runs in JavaScript you can inspect. There’s no server-side decryption path to accidentally expose data.

For moving files between devices without routing them through a third-party server, PairDrop works like AirDrop but across platforms and operating systems. Two devices on the same local network — or optionally paired via a code — transfer files directly peer-to-peer using WebRTC. The code is open source on GitHub. Files don’t transit PairDrop’s servers; the server-side component only handles the WebRTC signaling (coordinating the connection, not the data).

Unlike Wormhole or WeTransfer, PairDrop doesn’t set a file size limit derived from a freemium pricing model. The limit is your local network bandwidth.

For Privacy Configuration: Scripts You Read Before Running

privacy.sexy takes a different approach. Rather than being a browser-based tool you use directly, it generates privacy hardening scripts for Windows, macOS, and Linux. You browse categories of privacy settings (telemetry, advertising IDs, tracking services), select what you want to disable, and the tool generates a shell script you can read line by line before running.

The project is open source on GitHub. The scripts are shown in full before execution. This is the model that open source privacy tooling should follow: no trust required, just readable code doing described things. No account, no installer, no “allow this app to make changes.”

Open Source vs. Proprietary No-Login Tools

Not every no-login tool is open source, and the distinction has practical privacy implications.

The “Open Source + No Login” column represents the strongest privacy guarantee: no account to tie activity to, and code you can inspect to verify what the tool actually does. Proprietary no-login tools (like Photopea or Wormhole) can still be trustworthy — but they require trusting the company’s stated policies, which can change.

The “Open Source + Login Required” category is worth noting. Some open source projects do require accounts — usually for features that require server-side state, like collaboration history or cross-device sync. The login there serves an architectural purpose, not just a business one.

What “No Login Required” Actually Means

The phrase covers a wide range. At the weak end, it means the tool skips account creation but still fingerprints your browser and tracks sessions through cookies. At the strong end — where most of the tools above sit — it means genuinely client-side processing with no server-side state associated with your usage.

CyberChef operates entirely in your browser. Excalidraw’s drawing functionality is client-side. hat.sh’s encryption happens before any network request. PairDrop’s file data moves peer-to-peer. These aren’t privacy policy statements; they’re observable architectural properties.

The PrivacyTests.org project documents how browsers handle tracking protection, and most of the open source tools listed here work cleanly inside privacy-hardened browser configurations. No persistent cookies required, no third-party tracking scripts embedded in the page.

Is There a Complete No-Login Open Source Workflow?

For discrete tasks — the things you need to do once and not store indefinitely — the open source no-login ecosystem covers nearly everything.

Design: Excalidraw for diagrams and wireframes, Photopea for image editing, SVGOMG for SVG optimization. Development: Hoppscotch for API testing, CyberChef for data transformation, Regex101 for regular expressions, DevDocs for documentation. Privacy: hat.sh for file encryption, PairDrop for local file transfer, privacy.sexy for OS configuration.

The gap is persistent, cross-device storage. Anything that needs to sync state across sessions and devices either requires an account somewhere or requires self-hosting. That’s a real limitation, not a solvable one without infrastructure.

But for one-off tasks — and most of what people do online is one-off tasks — the tools above cover it without asking who you are.

The Auditability Argument, Stated Directly

Privacy claims from companies are legal commitments of variable enforceability, subject to terms-of-service changes and acquisition events. Privacy properties in open source code are technical facts that persist regardless of company decisions.

When hat.sh says your files are encrypted client-side before any server interaction, you can read the JavaScript to verify this. When PairDrop says file data moves peer-to-peer, the WebRTC implementation is public. When CyberChef says your input stays in your browser, the absence of network requests to external endpoints is testable.

Not everyone will read the code. But the open source security community will, and projects that claim one thing while doing another get caught quickly when the source is public. This is the practical mechanism by which open source privacy claims stay honest.

For a broader directory of no-login tools — open source and otherwise, across dozens of categories — nologin.tools maintains a verified list with health checks. The tools above are a starting point. The pattern they share — code you can read, computation that happens where you are — is worth looking for in every tool you rely on.