Built the same thing with a different tradeoff — Canvas API instead of WASM — so a couple
of notes from that side.
The privacy claim is stronger than you're stating it. Canvas re-encoding doesn't just avoid
the upload, it strips EXIF as a side effect: GPS coordinates, device model, timestamps all
disappear because you're drawing pixels to a new surface and calling toBlob(). For photos
straight off a phone that's often the actual risk, not the upload. Worth saying explicitly —
users don't know their images carry location data.
Two things Canvas gets wrong that WASM probably saves you from, and I'd be curious which
side you landed on:
- Canvas is sRGB by default. An image tagged Display P3 gets silently converted on draw, so
saturated colors shift. You need colorSpace: 'display-p3' on getContext to preserve it,
and support isn't universal.
- toBlob() quality is browser-dependent for JPEG. Quality 0.8 in Chrome and Safari are not
the same file. Fine for "make it smaller", not fine if someone is matching a target size.
For HEIC I ended up with a split: Safari decodes it natively through the OS at zero library
cost, and Chrome/Firefox lazy-load a WASM libheif build only after a HEIC file is actually
detected. Meant the other 95% of visits never download the decoder. If you're already fully
WASM you may not care, but the conditional load was worth the complexity for us.