Why I built a favicon generator that never uploads your logo

Onelogo began with a small annoyance. Every time a new site needed a favicon, the routine was the same: resize a logo into a dozen sizes, build an ICO file, hand-write a manifest and try to remember which tags belong in the head. The existing generators worked, but most asked for an upload, some wanted an account, and few explained what they had produced. The idea was a tool that does the whole job in one step and keeps the logo on your own machine.

Everything runs in the browser

The central decision was to have no backend at all. The Canvas API can already resample images, so every size is drawn directly in the page. The ICO file, a small binary format that bundles several images, is encoded by hand, and JSZip packs the results into a single download. The benefit is not only privacy. With no server there is nothing to scale, nothing to secure and nothing that can go down, and the tool is as fast as the visitor's own device.

Treat SVG as untrusted input

Letting people drop in an SVG sounds harmless until you remember an SVG can carry scripts, embedded objects and external references. Before an uploaded SVG is drawn or placed in the ZIP it is parsed and cleaned: scripts, foreignObject elements, event handlers and external links are removed. The page also ships with a strict Content-Security-Policy, so even a missed case has little room to do damage.

Be honest about what the output is

A raster logo cannot become a real vector, so the result card says whether favicon.svg is a true vector or a PNG wrapped in an SVG. Small details like this build trust. The same thinking led to a smart check that warns about low resolution, non-square images and fine detail that will vanish at 16 pixels, before the visitor downloads anything.

Guides, not only a generator

A generator answers how to make the files. Visitors usually also need to know where to put them. Onelogo includes install guides for WordPress, Shopify, Next.js, React, Vue, Angular and Webflow, plus checkers for an existing favicon and for a web manifest. Together they turn a one-off download into a complete answer.

What I would tell someone building something similar

• Decide early what you will not collect, and design so you never need it.
• Prefer the platform's built-in APIs over heavy libraries for image work.
• Make every output explain itself: what it is, where it goes, how to check it.
• Test with real files and real devices, not just unit tests.

Small tools can be genuinely useful when they respect the visitor's time and privacy. Onelogo is free, needs no account and keeps your logo on your device, and it sits alongside QRinst as part of the same goal: practical software that stays simple.