Why we built Tabularly: a tool that runs entirely in your browser

Last year I needed to merge two CSVs. One was 8MB of customer records from our CRM. The other was a smaller list of campaign signups. The merge was straightforward — match on email, output the union — but every “merge CSV files online” tool I tried wanted to upload the customer data to their servers. The customer data had personal contact info. I closed seven tabs.

I ended up writing a 12-line Python script. It worked. But it was the wrong tool for the situation: people who need to merge CSVs occasionally shouldn’t have to install Python.

I kept thinking about this. Modern browsers can run a SQL engine in WebAssembly. They can parse a 50MB spreadsheet. They can decode formats that didn’t exist when most of these online tools were built. The reason every “online CSV tool” still uses server-side processing isn’t that browsers can’t handle it — it’s that server-side processing is easier to monetize. Once your data is on their server, they can gate the result behind a signup. They can rate-limit the free tier. They can sell you a Pro plan.

That whole pattern is unnecessary now. Browsers are fast enough. JavaScript libraries like PapaParse and SheetJS are mature, and when JavaScript hits its ceiling, DuckDB compiled to WebAssembly can run real SQL on hundreds of megabytes of CSV — in the browser, in a worker thread. The user’s CPU is sitting there idle waiting to do the work. Why involve a server at all?

Tabularly is what that looks like when you commit to it. Six operations on tabular data — merge, append, dedupe, filter, sort, pick columns — running entirely in your browser. No upload. No signup. No gate.

The technical commitment

“Local-first” gets thrown around a lot. To make it more than marketing, we built an automated test that runs on every release. The test:

1. Loads the tool page
2. Drops a CSV file
3. Executes a join
4. Downloads the result
5. Captures every network request that fires between step 3 and step 5
6. Asserts that zero of those requests have a cross-origin URL

If that assertion fails, the release is blocked. The claim “your data never leaves your browser” is enforced by code, not by promise.

You can verify this yourself: open DevTools, go to the Network tab, drop a file, execute an op. You’ll see the page’s own JavaScript and CSS load. You won’t see anything carrying your file’s contents.

What we’re not doing

There are a lot of things we could do once we have your file on a server — train AI models on it, build a recommendation engine, sell aggregated insights to a third party, retarget you with ads, fingerprint your browser. We’re not doing any of those things because we never have your file in the first place.

We use one analytics service: Cloudflare Web Analytics. It’s cookieless, IP-anonymized, and records categorical event counts (like “a join operation was executed”) but never anything about the data itself — no filenames, no column names, no row counts, no values. That’s the privacy commitment, written down in our privacy page.

The roadmap

The Free tier handles files up to 10 MB with an in-memory engine that runs on the page itself. Pro uses DuckDB-WASM in a worker thread to handle files of any size — still entirely in your browser, still no upload. Both tiers ship the same six operations. Up next: cloud connectors (Drive, Dropbox, OneDrive), an AI sidebar (bring-your-own API key, with the tool config emitted as structured output the AI invokes), and an offline desktop app.

Everything stays local-first. That’s the constraint that defines the product.

If you build software

If you’re building anything that touches user data, ask yourself: do you actually need that data on your server? If the answer is “for convenience” — convenience for whom? The user’s convenience would be not having to trust you. Your convenience is rarely a reason to keep their data.

Browsers can do more than we give them credit for. The internet doesn’t have to be a thin client to a server farm. Some of the most useful tools are the ones where the client does all the work.

— Yang