ToolBox Pro - What You Get and How It Works

Why ToolBox Has a Pro Tier

ToolBox launched as a free tool suite. All 139+ tools, no accounts, no sign-up, no tracking. That has not changed. Every tool on the site still works for free. The core tools will stay free permanently.

But running a tool site has costs. Hosting, domain, CDN, API integrations, development time. Ads are the default way most tool sites monetize, and most of them go heavy on it - interstitials, pop-ups, autoplaying video ads in sidebars. That approach works financially, but it degrades the product for the people actually using it.

ToolBox Pro is the alternative. Pay a subscription, get more capacity, and the ads disappear. The free tier stays fully functional with reasonable limits. Pro removes those limits and adds the API.

This post covers exactly what free users get, what Pro adds, how the subscription system works technically, and why we built it the way we did.

---

What Free Users Get

Free users have access to every tool on the site. No tools are locked behind the paywall. The limits apply to usage volume, file size, and batch operations.

50 Operations Per Day

Free users can perform 50 tool operations per day. An "operation" is counted each time you process data through a tool - formatting JSON, converting a file, generating a hash, running a diff.

The counter resets at midnight based on your local timezone. It is tracked in localStorage on your device:

interface DailyUsage {
  date: string; // YYYY-MM-DD format
  count: number;
}

When the stored date does not match today's date, the counter resets to zero. No server is involved. No one tracks how many operations you have performed.

For most casual use, 50 operations per day is plenty. If you open the JSON Formatter once to clean up an API response, that is one operation. If you are batch-processing 40 CSV files, you will hit the limit.

10MB File Size Limit

File-based tools (PDF merge/split, image conversion, file hash, etc.) accept files up to 10MB on the free tier. This covers most document and image processing tasks.

The 10MB limit is enforced client-side before any processing begins. The file never leaves your device regardless - there is no upload to a server.

Single File Processing

Batch operations (processing multiple files at once) are limited to 1 file at a time on the free tier. If a tool supports drag-and-drop of multiple files, free users process them one at a time.

Ads Visible

Free users see non-intrusive ads on tool pages. These are standard display ads - no pop-ups, no interstitials, no autoplaying video. They exist because the free tier needs to generate some revenue to justify the server and development costs.

---

What Pro Adds

Pro removes all the free-tier limits and adds the programmatic API.

Unlimited Operations

No daily operation limit. Use every tool as many times as you want. The daily counter still exists in the code, but the isDailyLimitReached function returns false when the user has an active Pro subscription:

export function isDailyLimitReached(isPro: boolean): boolean {
  if (isPro) return false;
  return getDailyUsageCount() >= FREE_DAILY_LIMIT;
}

100MB File Size Limit

File size limit increases from 10MB to 100MB. This makes the PDF tools, image converters, and file hash tools usable for larger files. The limit is still enforced client-side:

export const FREE_FILE_SIZE_LIMIT = 10 * 1024 * 1024;  // 10 MB
export const PRO_FILE_SIZE_LIMIT = 100 * 1024 * 1024;   // 100 MB

Batch Processing

Batch operations support up to 20 files at once instead of 1. Drop 20 images into the Image Converter and process them all in a single operation.

21 API Endpoints

Pro subscribers get access to the ToolBox API - 21 REST endpoints plus a tool-chain pipeline with 35+ processors. The API runs on Cloudflare Workers and uses Bearer token authentication.

The API lets you use ToolBox capabilities from scripts, CI pipelines, and backend services. JSON formatting, hashing, Base64 encoding, CSV conversion, diff computation, regex testing, and more - all accessible via HTTP.

See the full API documentation for endpoint details and curl examples.

No Ads

All ads are hidden for Pro subscribers. The ad components check the Pro status and do not render:

if (isPro) return null; // Don't render ads for Pro users

This applies to every page on the site, not just tool pages.

---

How the Subscription Works

The subscription system was designed with the same privacy principles as the rest of ToolBox: no accounts, no tracking, minimal data collection.

No Account Required

There is no sign-up form, no username, no email collection for account creation. You do not create an account to use ToolBox Pro. You purchase a subscription through a payment provider, receive a subscription ID, and enter that ID on the Pro page.

The subscription ID is stored in your browser's localStorage. When you open ToolBox, the site checks if there is a valid subscription ID stored locally, and if so, verifies it with the payment provider.

Payment Providers

ToolBox uses Dodo Payments for all payment processing. Dodo Payments handles tax calculation, currency conversion, and payment processing for users worldwide. It supports credit cards and other payment methods depending on your region.

Subscription Verification

When you enter your subscription ID on the Pro page (or when the site loads with a stored ID), the site sends a verification request to the ToolBox API:

POST /api/paddle/verify
Body: { "subscriptionId": "sub_xxxxx" }

The API server calls the Dodo Payments API to check the subscription status. The response contains the subscription status: active, canceled, past_due, paused, or unknown.

If the status is active, the site stores the verified subscription data in localStorage:

interface ProLicense {
  subscriptionId: string;
  provider: "dodo";
  status: "active" | "canceled" | "past_due" | "paused" | "unknown";
  verifiedAt: number; // timestamp of last verification
}

The verifiedAt timestamp is used to avoid re-verifying on every page load. The site only re-verifies if the last verification was more than a certain time ago.

Device Limiting

A single Pro subscription can be used on up to 3 devices within a 30-day window. This prevents a single subscription from being shared across unlimited devices.

The device limiting works by tracking hashed IP addresses in Cloudflare KV storage:

1. When you verify your subscription, the API receives your IP address from the CF-Connecting-IP header
2. The IP is hashed with SHA-256 using a salt to create a privacy-preserving identifier (only the first 16 hex characters are stored)
3. The hash is stored in a KV record keyed by the subscription ID
4. Each record can hold up to 3 IP hashes
5. KV records expire after 30 days automatically via TTL

const MAX_DEVICES = 3;
const TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days

async function checkDeviceLimit(subscriptionId, clientIP, kv) {
  const key = `rl:${subscriptionId}`;
  const ipHash = await hashIP(clientIP);

  const record = await kv.get(key, 'json') || { ips: [] };

  if (record.ips.includes(ipHash)) return { allowed: true };
  if (record.ips.length >= MAX_DEVICES) return { allowed: false };

  record.ips.push(ipHash);
  await kv.put(key, JSON.stringify(record), { expirationTtl: TTL_SECONDS });
  return { allowed: true };
}

A few important details about this system:

• IP addresses are never stored in plain text. Only SHA-256 hashes (truncated to 16 characters) are kept.
• If your IP changes (e.g., you switch networks), that counts as a new device. This is a trade-off between security and convenience.
• The 30-day TTL means device slots free up automatically. If you stop using a device, its slot expires after 30 days.
• If KV is unavailable, the system fails open - it allows the request. We would rather let a user in than lock them out due to infrastructure issues.

What Gets Stored Where

Here is a complete breakdown of what data exists and where:

The ToolBox server does not store your email, name, payment details, or any personal information. The payment providers handle all of that. The only server-side data is the hashed IP record in KV, which cannot be reversed to identify you.

---

The Privacy Angle

Most SaaS products require an account. You provide an email, create a password, and your usage is tracked in a database tied to your identity. Some products use this data for analytics. Some sell it. Some get breached and your data ends up in HIBP.

ToolBox Pro works differently.

There is no user database. There are no accounts. The subscription ID is the only identifier, and it is managed by the payment provider (Dodo Payments), not by ToolBox.

When you use a tool, the processing happens in your browser. Your data does not leave your device. The Pro subscription only changes local behavior - it increases limits and hides ads by toggling a flag in JavaScript.

The verification endpoint is the only part that involves a server. It receives a subscription ID, calls the payment provider's API to check the status, checks the device limit in KV, and returns active or inactive. That is the entire server interaction. No logs of which tools you used. No analytics on your usage patterns. No telemetry.

This is possible because of the client-side architecture. All tool logic runs in the browser using Web APIs (Canvas, Web Crypto, FileReader, TextEncoder, etc.). The server is only needed for two things: verifying that you paid, and running the Pro API endpoints.

---

Pricing

ToolBox Pro is available as a monthly or yearly subscription. Yearly saves money over 12 individual months.

Pricing is handled by Dodo Payments, which supports multiple currencies based on your region.

You can cancel at any time. After cancellation, Pro features remain active until the end of your current billing period. After that, you revert to the free tier - all tools still work, just with the standard limits.

---

Technical Details for Developers

If you are curious about how the Pro system is implemented, here are the key files:

Pro Status Detection

The lib/pro-limits.ts file exports all the limit constants and helper functions:

export const FREE_FILE_SIZE_LIMIT = 10 * 1024 * 1024;  // 10 MB
export const PRO_FILE_SIZE_LIMIT = 100 * 1024 * 1024;   // 100 MB
export const FREE_BATCH_LIMIT = 1;
export const PRO_BATCH_LIMIT = 20;
export const FREE_DAILY_LIMIT = 50;

Each tool checks the Pro status and adjusts its behavior accordingly:

const fileLimit = getFileLimit(isPro);
const batchLimit = getBatchLimit(isPro);
const dailyLimitReached = isDailyLimitReached(isPro);

Subscription Storage

The lib/paddle.ts file defines the subscription data structure and payment provider configuration:

export const PRO_STORAGE_KEY = "toolbox-pro-subscription";

export interface ProLicense {
  subscriptionId: string;
  provider: "dodo";
  status: "active" | "canceled" | "past_due" | "paused" | "unknown";
  verifiedAt: number;
}

File Size Enforcement

The isFileTooLarge function checks files before processing:

export function isFileTooLarge(file: File, isPro: boolean): boolean {
  return file.size > getFileLimit(isPro);
}

When a file exceeds the limit, the tool shows an upgrade modal explaining the Pro file size limit and offering a link to the Pro page.

Daily Usage Tracking

Usage is tracked per calendar day using a simple counter in localStorage:

export function incrementDailyUsage(): number {
  const usage = getDailyUsage();
  usage.count++;
  localStorage.setItem(DAILY_USAGE_KEY, JSON.stringify(usage));
  return usage.count;
}

When the date changes, the counter auto-resets because the stored date no longer matches todayStr().

---

Frequently Asked Questions

Can I use Pro on multiple devices?

Yes, up to 3 devices within a 30-day rolling window. Enter your subscription ID on each device. Devices are identified by IP hash, so different networks count as different devices.

What happens if I clear my browser data?

You will need to re-enter your subscription ID on the Pro page. The subscription itself is not affected - it is managed by the payment provider. Just enter the ID again to re-activate Pro features.

Can I use the API and the web tools at the same time?

Yes. They use the same subscription but are independent. The API has its own rate limits separate from the web tool usage counter.

Do free tools work offline?

Yes. ToolBox is a PWA (Progressive Web App). After your first visit, tools are cached by the service worker and work offline. This applies to both free and Pro users. The Pro status check happens when you first load the site, and the status is cached locally.

What happens if the payment provider is down?

If Dodo Payments is temporarily unavailable during verification, the site falls back to the last known status stored in localStorage. If you were previously verified as Pro, you stay Pro until the next verification attempt.

Is there a refund policy?

Subscriptions can be canceled at any time through the payment provider. Contact us at support@toolbox-kit.com for refund requests.

Why not just use API keys without a subscription?

The subscription model bundles web and API access together. Having a single subscription that unlocks both the enhanced web experience and the API keeps things simple. One payment, one ID, everything works.

---

Free vs Pro Comparison

---

How Pro Interacts with Other Features

Split View

Split View works the same for free and Pro users. Both panes share the same Pro status, so if you are Pro, both tools in the split view have Pro limits.

Tool Chainer

The web-based Tool Chainer works the same for everyone. The Pro API adds a programmatic tool-chain endpoint (/api/v1/tool-chain) with 35+ processors that you can call from scripts.

Snippets Library

Snippets Library storage is the same for free and Pro users - up to 50 snippets in localStorage. There is no Pro-only snippet limit increase.

Right-Click Menu

The right-click quick actions work identically for free and Pro users. No Pro gating on that feature.

---

The Upgrade Modal

When a free user hits a limit - daily operations, file size, or batch processing - a modal appears explaining what happened and what Pro offers. The modal includes:

• Which limit was reached
• What the Pro limit would be
• A link to the Pro page

The modal does not block the page. You can dismiss it and continue using the site. It only appears at the moment you hit a specific limit, not preemptively.

The modal is triggered in the same function that checks limits:

if (isDailyLimitReached(isPro)) {
  showUpgradeModal('daily-limit');
  return;
}

The modal has different variants depending on which limit was hit. The file size variant shows the current file size, the 10MB limit, and the 100MB Pro limit. The daily limit variant shows the current count (50/50) and explains that Pro removes it entirely.

---

File Size Enforcement Across Tools

File size limits are enforced consistently across all file-handling tools. Here is a partial list of tools that enforce the 10MB/100MB limit:

The enforcement happens before processing begins. The file is checked against the limit, and if it exceeds the limit, the upgrade modal appears. No partial processing occurs.

export function isFileTooLarge(file: File, isPro: boolean): boolean {
  return file.size > getFileLimit(isPro);
}

The getFileLimit function returns either 10 * 1024 * 1024 (10MB) or 100 * 1024 * 1024 (100MB) based on Pro status.

For context, 10MB covers most individual documents, photos, and small audio clips. 100MB covers larger assets like high-resolution images, multi-page PDFs, longer audio recordings, and bulk CSV datasets.

---

How the Pro API Works

The Pro API is a set of 21 REST endpoints plus a tool-chain pipeline endpoint. Every endpoint runs on Cloudflare Workers at the edge and uses Bearer token authentication.

API Authentication

API requests require a Bearer token with the tb_ prefix:

curl -X POST https://toolbox-kit.com/api/v1/json-format \
  -H "Authorization: Bearer tb_your_key" \
  -H "Content-Type: application/json" \
  -d '{"json": "{\"key\": \"value\"}"}'

API Endpoint Categories

The 21 endpoints cover six categories:

JSON and Data - json-format, json-minify, json-validate, csv-json, diff

Encoding - base64, url-encode, html-entities

Hashing and Security - hash (SHA-256/SHA-1/MD5), hmac, password-generate

Text Processing - text-stats, case-convert, slugify, markdown-html

Utilities - uuid, timestamp, lorem-ipsum, color-convert, number-base, jwt-decode, regex-test

Tool Chainer - A pipeline endpoint that chains 35+ text processors in sequence. You define a series of steps, and each step's output feeds into the next step.

curl -X POST https://toolbox-kit.com/api/v1/tool-chain \
  -H "Authorization: Bearer tb_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "input": "  Hello World  ",
    "steps": [
      {"processorId": "trim"},
      {"processorId": "lowercase"},
      {"processorId": "sha256"}
    ]
  }'

For complete API documentation with curl examples for every endpoint, see the full API reference.

---

Why No Accounts

Most SaaS products start with account creation. Email, password, maybe OAuth. Then they have to deal with:

• Password reset flows
• Email verification
• Session management
• User database security
• GDPR data access/deletion requests
• Cookie consent for authentication cookies

ToolBox skips all of this. The subscription ID is the only identifier. It is generated by the payment provider (Dodo Payments), stored in your browser, and verified on demand by calling the payment provider's API.

This has trade-offs. You cannot log in on a new device without your subscription ID. You cannot recover your subscription through an "I forgot my password" flow. If you lose your subscription ID and clear your browser data, you need to contact the payment provider to retrieve it.

For the typical ToolBox user - a developer who runs tools in their browser and might use the API in scripts - this trade-off makes sense. The simplicity of no accounts outweighs the minor inconvenience of managing a subscription ID.

---

Subscription Lifecycle

Here is the full lifecycle of a Pro subscription:

Purchase

1. User visits /pro and clicks Subscribe
2. Dodo Payments checkout opens
3. User completes payment
4. Payment provider returns a subscription ID
5. The site stores the subscription ID in localStorage and verifies it immediately
6. Pro features activate

Ongoing Use

1. User opens ToolBox
2. Site checks localStorage for a stored subscription
3. If found, sends verification request to /api/dodo/verify
4. Server checks subscription status with payment provider
5. Server checks device limit in KV
6. Returns active or error
7. Site updates local Pro status

Cancellation

1. User cancels through their account settings or contacts support
2. Subscription remains active until end of current billing period
3. After the period ends, verification returns canceled
4. Site reverts to free-tier limits
5. All tools continue to work - just with standard limits

Device Change

1. User copies subscription ID from Pro page
2. Opens ToolBox on new device
3. Enters subscription ID on Pro page
4. Verification runs and checks device limit
5. If under 3 devices, the new device is registered
6. If at 3 devices, returns error with 30-day window explanation

---

Comparison with Other Tool Sites

Most tool sites use one of these monetization approaches:

Heavy advertising - Sites like CodeBeautify and FreeFormatter show multiple ad units per page, sometimes with interstitials between operations. Revenue scales with page views, so the incentive is to make users view more pages (splitting tools across multiple pages, adding unnecessary steps).

Freemium with account walls - Some tools require account creation to use basic features. The free tier exists to collect emails for marketing. The conversion funnel runs through email campaigns and usage-based triggers.

Per-use pricing - Some API services charge per request from the start. No free tier for evaluation, or a very limited trial period.

Open source donations - Some projects are free and survive on GitHub sponsorships or donations. This works for developer-focused projects with strong community following but is unreliable as a primary revenue source.

ToolBox Pro sits between these models. The free tier is genuinely useful - 50 operations per day, 139+ tools, no account required. The Pro tier adds capacity and the API for users who need more. No email harvesting, no aggressive upselling, no feature gating on core tools.

---

Behind the Scenes: How Pro Status Propagates

When Pro status is verified, it propagates through the application via React context. The Pro status is checked once (on page load or verification) and made available to all components through a context provider.

Tool components consume this context:

const { isPro } = useProStatus();
const fileLimit = getFileLimit(isPro);

This means there is no per-tool Pro check. The status is determined once and shared. If a tool needs to check whether to show a batch upload UI or a single-file upload UI, it reads isPro from context.

The context also handles the case where Pro status changes during a session. If you subscribe while ToolBox is open, the new status propagates immediately when verification completes. You do not need to reload the page.

---

Getting Pro

1. Go to the Pro page
2. Select monthly or yearly billing
3. Complete payment through Dodo Payments
4. Your subscription ID is automatically activated in your browser
5. Pro features are immediately available

If you need to activate on another device, copy your subscription ID from the Pro page (there is a copy button) and enter it on the new device.

That is it. No account creation, no email verification, no profile setup. Purchase, activate, use.