Base64 Converter Pro v0.4.2 was checked through its visible controls in an isolated Chromium session. The full browser evidence is saved in assets/concepts/2026-09-09-marketing/review/final-browser. Approved marketing captures are in review/final-marketing, with the chunked conversion result in review/large-file.
| Step | Flow | Health | What was exercised |
|---|---|---|---|
| 1 | File encode | Healthy | A real text file produced complete Base64, correct MD5 and SHA-256 values, a JSON download and a QR GIF. A second file confirmed the batch ZIP contents. A 50 MiB plus 17 byte fixture exercised the chunked path without changing the output. |
| 2 | Text conversion | Healthy | Unicode Base64, Hex decoding, UTF-7 round-trip and clear guidance for file-only formats were checked through the Text tab. |
| 3 | Decode tools | Healthy | A data URI rendered as a PNG preview. Hex dump, entropy output and an SPF record with preserved spaces were also checked. |
| 4 | JWT inspection | Healthy | A sample HS256 token displayed its claims, reported expiry status accurately, accepted the matching test secret, rejected a different secret and cleared the secret. |
| 5 | Offline and install | Healthy | The app reloaded offline with its ZIP and QR libraries. A disconnected first launch from index.html worked. The PWA was installed, launched and removed in an isolated Chromium profile. |
| 6 | Responsive and accessible controls | Healthy | Dark and light desktop layouts plus a 390 by 844 viewport had no horizontal page overflow. Form controls had programmatic labels, dialogs exposed names and reduced-motion behavior was enabled. |
The five README and manifest screenshots were captured from working states with harmless sample data. They were reviewed at their stored resolution. The simplified B64 icon was also rendered at 512, 128, 32 and 16 pixels. The primary SVG has transparent corners for ordinary use, while the manifest's maskable SVG fills its canvas for installed app shapes.
The clipboard permission prompt and native file-picker dialog were not automated. File input itself was exercised with real browser file objects. Fetch behavior still depends on the destination server's CORS policy. The mobile checks use a browser viewport rather than a physical phone. Browser installation behavior can vary by platform even though the isolated Chromium install, launch and removal check passed.
These checks do not certify security, accessibility conformance or support in every browser. JWT verification covers HMAC algorithms only. Certificate inspection does not establish trust, and encoding is not encryption.