How Diffspot works
Every comparison runs on your device. This page explains how, and how you can check it yourself.
The short version
- When you open Diffspot, your browser downloads the page and a diff engine written in Rust and compiled to WebAssembly.
- Everything you paste or open is processed by that engine inside the browser tab, in a background thread. There is no upload step and no server that receives your text or files.
- Nothing you compare is stored. Close the tab and it's gone. Only display preferences (like side-by-side or unified view) are saved, in your browser.
- Ads are shown in a separate, sandboxed frame from a different origin. Browsers block that frame from reading the page, so ad code can't see what you compare.
What happens when you compare
Text and code
The two texts are sent to a Web Worker (a background thread in the same tab) running the WebAssembly engine. It splits them into lines and computes the differences with the histogram algorithm, the one Git offers as git diff --histogram, with an indentation heuristic so that changes line up the way a person would expect. A second pass compares changed lines word by word or character by character, and a third finds blocks that moved. The language is detected and highlighted by a purpose-built Rust lexer. The result comes back as a compact binary structure, and the viewer only draws the rows on screen, so a 100,000-line file scrolls as smoothly as a short one.
Documents
PDFs are opened with Mozilla's pdf.js, running in your browser, and their text is rebuilt line by line. Word (.docx), PowerPoint (.pptx) and OpenDocument files are unzipped and read by the Rust engine. The extracted text is then compared like any other text.
Spreadsheets
Excel, OpenDocument and CSV files are parsed in WebAssembly. Columns are matched by header name, rows by position or by a key column you choose, and each changed cell is reported with its old and new value.
Images
Both images are decoded by your browser and compared pixel by pixel using a perceptual color distance, ignoring differences caused only by anti-aliasing.
Folders
When you choose a folder, your browser gives the page read access to the files in it. Diffspot matches files by path, compares sizes, and confirms files of equal size by hashing their contents (XXH3). Files are read one at a time, only on your device.
Share links without a server
A share link contains both texts, compressed, in the part of the URL after the # sign (the fragment). Browsers never send the fragment to the server when they load a page, so opening a link decodes the texts locally. Note that anyone who has the link can read the texts, and links to large texts are long.
How ads are kept away from your data
Ads pay for Diffspot, but ad code never runs in the page that holds your text. Each ad is loaded in an <iframe> from ads.diffspot.io, a different origin from diffspot.io. The browser's same-origin policy prevents a cross-origin frame from reading the page's content, its text boxes or its URL fragment. The frame is also sandboxed so it can't navigate this page away (and lose your work). It is told only which ad slot it is and which page of the site it's on (for example /json-diff), never anything you entered.
Check it yourself
- Open your browser's developer tools (F12 or ⌘⌥I) and select the Network tab.
- Paste text or open files and compare them.
- You'll see no request carrying your content. After the first load, the only requests come from the ad frames, which belong to a different origin.
You can also load Diffspot once, disconnect from the internet, and keep comparing: the app works offline.
Security headers
Diffspot is served with a strict Content Security Policy that only allows scripts from diffspot.io itself, blocks the page from being embedded elsewhere, and isolates it from windows it opens. No third-party scripts run on the page.