Here's something that didn't happen with an announcement: the floor for what a browser can compute, without sending your data anywhere, has risen considerably in the past two years. Not because browsers got flashy new APIs, but because specific WebAssembly capabilities — SIMD instructions, the GC proposal, threading — matured enough that tool developers could actually rely on them.

The tools that benefited are exactly the ones that don't require a login. That's not a coincidence. When computation moves fully into the browser, the justification for user accounts evaporates. No server processing means no job to track, no identity to associate with a request, no email required to retrieve your results.

If you've already read the basics of how WebAssembly powers free browser tools, this goes a level deeper: what specifically has improved, what tool categories are now practical that weren't before, and why the architectural shift matters for privacy in particular.

SIMD Changed the Speed Ceiling for Image and Audio Tools

SIMD — Single Instruction, Multiple Data — lets a CPU operate on multiple data values in a single operation instead of one at a time. For image encoding, this means processing a row of pixels simultaneously rather than sequentially. For audio analysis, it means running FFT computations across thousands of samples at once.

WebAssembly SIMD shipped across all major browsers between 2021 and 2022. The timing matters: before SIMD, Wasm was faster than JavaScript for compute-heavy work, but not fast enough for some codec operations to be practical at interactive speeds. After SIMD, tools could run the same algorithms that desktop apps use.

Squoosh is the clearest demonstration. The AVIF encoder (using libaom, a C library compiled to Wasm) and the WebP encoder both use SIMD-accelerated paths when the browser supports them. Early versions of Squoosh could encode AVIF, but it was slow enough to feel like a toy. With SIMD, encoding times dropped to the point where Squoosh can show a live quality comparison preview as you drag the slider — the same experience you'd expect from native software, running in a browser tab, with no account and no upload to a remote server.

Audio tools tell the same story. When you need to edit audio without installing software, AudioMass handles waveform editing, effects, and format conversion entirely in-browser. The operations that make audio editing feel responsive — detecting silence, applying filters, rendering waveforms at scale — involve exactly the kind of repeated numerical computation that SIMD accelerates. A few years ago, "online audio editor" generally meant uploading a file and getting a processed result back. The upload wasn't just architecture; it was a necessity because browsers were too slow for the alternative. Now it's just architecture — and for no-login tools, the right architecture eliminates servers entirely.

The GC Proposal: More Languages, New Tool Categories

The WebAssembly GC proposal — native garbage collection support in the Wasm runtime — shipped in Chrome 119 and Firefox 120 in late 2023. Before this, compiling a garbage-collected language like Python, Kotlin, or Dart to Wasm meant bundling an entire GC runtime into the Wasm binary. The files were large and startup was slow.

With native GC, the browser provides garbage collection directly. Languages compile to smaller, faster-loading Wasm binaries, and the startup overhead shrinks considerably.

The practical effect shows most clearly in database tools. Datasette Lite runs a complete SQLite database engine — compiled from C to Wasm via the official SQLite Wasm build — plus a Python environment via Pyodide, entirely in your browser tab. Load a CSV file, write a SQL query, filter and export results. Nothing reaches a server. The data analysis happens on your hardware, in your browser, with no registration and no cloud service holding your dataset.

The SQLite Wasm build is worth noting specifically: it's maintained by the SQLite project itself. This isn't a weekend port. The same team that maintains one of the most carefully tested pieces of software ever written — deployed on billions of devices — compiles and releases the official Wasm version. The engineering standards are consistent, and the build is auditable.

Pyodide, which brings CPython to the browser, benefits from GC improvements as well. This enables a pattern that seemed far-fetched a few years ago: tools that use Python's data analysis ecosystem (NumPy, pandas, and similar libraries) running fully client-side, without any Python installation, without an account on a cloud service.

Threading: Parallel Computation With a Catch

WebAssembly Threads allow Wasm modules to create worker threads that share memory via SharedArrayBuffer — real CPU-level parallelism, not just JavaScript's asynchronous model. For tasks like video transcoding or large dataset processing, this matters: you can split work across CPU cores instead of running everything sequentially.

The catch is architectural. Threading requires specific HTTP response headers: Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp. These exist to prevent Spectre-style side-channel attacks that SharedArrayBuffer makes more feasible. Most static hosting setups don't send these headers by default.

This creates a real tension for privacy-focused no-login tools. The simplest hosting model — deploy a folder of static files to a CDN — doesn't enable Wasm threading without additional configuration. Tools that prioritize zero-trust deployment sometimes trade threading performance for architectural simplicity.

hat.sh illustrates this tradeoff well. It uses libsodium (a thoroughly audited cryptographic C library) compiled to WebAssembly for file encryption and decryption. The encryption runs in a Wasm sandbox with no threading, but that's acceptable because the operations hat.sh handles — file encryption with ChaCha20-Poly1305, key derivation, signature verification — are fast enough without parallelism for most practical file sizes. The architectural properties matter more here than the extra speed: the Wasm module has no independent network access, the source is open, and the tool deploys on simple static hosting that doesn't require any backend infrastructure.

For tools where threading genuinely changes what's practical, the FFmpeg case is the headline example. FFmpeg compiled to WebAssembly — ffmpeg.wasm, which has been available as an open-source project for several years — can transcode video, extract audio, and convert between container formats in the browser. This required threading to be useful because single-threaded video transcoding is too slow for practical use. The tradeoff: hosting it with the required headers is slightly more involved than a plain CDN deployment.

What's Now Possible That Wasn't Before

The combination of SIMD speed, GC support for higher-level languages, and threading has opened tool categories that previously had hard technical justifications for requiring server infrastructure:

cFIREsim shows how this plays out for something less obviously compute-intensive: a retirement portfolio simulator that models historical market data against withdrawal strategies. Running thousands of Monte Carlo simulations across historical market sequences is genuinely computational work. It runs entirely in your browser — no account, no server processing your financial data — because the computation fits well within what modern JavaScript and Wasm can handle.

The Privacy Argument Is Structural, Not Rhetorical

Most "privacy-friendly" claims from web services are policy statements. They describe what a company promises to do or not do with your data. This is not the same as a structural guarantee.

Wasm-based tools where computation happens client-side offer a different kind of claim. The WebAssembly specification defines this directly: Wasm modules run in the same sandbox as JavaScript and can access external state — including the network — only through explicit JavaScript interop. A Wasm module that processes your files cannot independently initiate an HTTP request to send those files somewhere. JavaScript would have to explicitly do that.

For open-source tools, you can verify the JavaScript doesn't do this. The source is readable. This is what "auditable" means in practice: not "we claim our engineers reviewed the code," but "you can read it yourself."

The Mozilla Developer Network's documentation on WebAssembly security makes this explicit: Wasm code "can access and modify memory and tables passed to it through its imports, and can call functions passed to it through its imports. It cannot otherwise access any state outside of its module." The constraint is built into the specification, not a product decision a company can walk back.

This distinction — structural vs. policy-based privacy — is why no-login tools that run computation locally are meaningfully different from tools that offer the same features with a "we don't store your data" badge in the footer. Both might be accurate. Only one is verifiable.

Where This Is Heading

The WebAssembly Component Model, maintained by the Bytecode Alliance, is the next significant change. It defines how Wasm modules compiled from different languages can interoperate without going through JavaScript as a bridge. Today, composing a Rust library with a Python library in a browser tool requires manual integration work at the JS boundary. The component model standardizes this.

The practical implication for no-login tools: more specialized, well-maintained libraries from existing ecosystems become easier to combine into browser-based tools. A tool that needs a Rust cryptographic library, a Python analysis library, and a C audio codec doesn't have to be written by someone fluent in all three ecosystems. Composable Wasm components lower the barrier.

WASI Preview 2 (the WebAssembly System Interface) extends this for environments outside the browser, but the same composability principles apply. The ecosystem of Wasm-compatible library components is growing separately from the browser-specific tooling, which eventually benefits both.

What's currently baseline for free browser tools without signup — real image encoding, SQL databases, in-browser cryptography — took roughly four years to become normal after WebAssembly shipped in browsers. The Component Model has been in development for several years and is reaching maturity now. Whatever the next set of "this should require a server" assumptions turns out to be wrong about, we'll probably know in the next two or three years.

The full list of tools that have already moved to this model, no account required, is at nologin.tools.