Free the Tools at work
A note for IT teams. The tools run inside the browser, so files never leave the computer. To allow them, allow one site: freethetools.com.
What to allow
| Address | What it is | Needed for |
|---|---|---|
https://freethetools.com/ | Pages, scripts, fonts and tool engines. www.freethetools.com redirects here. | Everything |
/api/stats/ on the same site | Anonymous counts: a tool's name and an event such as “used”. Never a file or its contents. | Nothing. Blocking it is fine. |
/api/feedback on the same site | The “Suggest a tool” form, only when someone sends it | The form |
There are no other domains: no CDNs, web fonts, analytics or ads. Every page carries a Content Security Policy with connect-src 'self', so the browser itself refuses any connection to another server.
A newly registered domain is often blocked by web filters as new or uncategorised. If yours blocks it, add freethetools.com to your allow list.
Uploads and data loss prevention
A tool reads a file with the browser's own file picker and works on it inside the tab. No upload request is made, so rules that block uploads are not triggered, and no file reaches us.
Results are saved through the browser's normal download. Your download rules still apply to them. Results are documents, images, text and ZIP files.
Browser features it uses
- JavaScript and Web Workers: every tool.
- WebAssembly: only Compress PDF (Ghostscript) and Unlock PDF (qpdf). The files come from this site.
- Service worker: keeps the tools someone has opened, so they work offline. Optional: without it, the tools still work online.
- Local storage and IndexedDB: favourites, settings and the Library of recent results. Optional, and it stays in that browser.
Microsoft Edge's enhanced security mode runs WebAssembly through a slower interpreter. Microsoft recommends adding a site that needs it as an exception: in Edge, Settings, then Privacy, search, and services, then Manage enhanced security for sites. Setting the EnhanceSecurityMode policy to Strict, or DefaultJavaScriptJitSetting to BlockJavaScriptJit, applies the mode to every site, so add freethetools.com as an exception there too (Microsoft's guide).
Install it for everyone
Microsoft Edge (version 80 or later) and Google Chrome can install the site as an app for every user with the WebAppInstallForceList policy. It then opens in its own window and keeps working offline once opened.
[{"url": "https://freethetools.com/", "default_launch_container": "window", "create_desktop_shortcut": true}]Run your own copy
The site is a set of static files, so you can host it inside your network. The self-hosting guide shows how.
Check it yourself
- How it works lists exactly what the site sends, and how to watch it in the browser's Network tab.
- Verify this site checks the live files against the published build.
- The source code is open, under the AGPL-3.0 licence.
- Report a security problem to security@freethetools.com, or see the security policy.
Last updated: 2026-10-12