"100% Local" Is About Your Media Files — The Price of Running Whisper and ffmpeg as WASM

"100% local" means your media files don't leave. It doesn't mean no data leaves. And the price of running locally comes back as a model download on first run plus a SharedArrayBuffer requirement that needs server configuration. After this you'll know what to check when picking a "local-first" tool, and what you're signing up for if you build one.

What I ran

rescript (github.com/wassgha/rescript) was going around on Threads: "delete words from the transcript and the video and audio get cut to match, 100% local in the browser." I cloned it and ran it myself (2026-08-24).

npm install    741 packages / node_modules 1.3GB
startup        Next.js 16, Ready in 273ms
transcription  sample video (11.5s) transcribed correctly, with speaker labels and a word-level timeline

A three-sentence sample I recorded came out with no typos. The transcription quality was good.

What "local" actually is

It's not that there's no server. The model and ffmpeg are pushed whole into the browser. Per the README, transcription runs Whisper (timestamped base and small variants) through transformers.js, and cutting and export are done by multi-threaded ffmpeg.wasm (ffmpeg compiled to WebAssembly). Inference uses WebGPU when available and falls back to WASM otherwise.

Price 1: what it needs to run

The README recommends a Chromium-based browser and says the web app needs SharedArrayBuffer. Multi-threaded ffmpeg uses it to share memory between threads. The catch is that it's only available when the page is crossOriginIsolated, and for that the server hosting the page has to send two headers.

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

So to process locally, you have to touch server config. Turning on require-corp also blocks external images and scripts that lack CORP or CORS headers, so if you add this to an existing service, audit your third-party resources first.

Price 2: first run

Right after I loaded a file, a "downloading speech model… 4%" message appeared. The model gets downloaded into the browser. I haven't measured the size or how long it takes yet. With server-side transcription, users never see this wait.

Telemetry is on by default, though

According to the README, anonymous usage stats and crash reports (sent to Sentry) are on by default. You can turn them off under Settings → Privacy. I haven't checked yet whether the network requests actually stop after that.

That's not a criticism. The README says it plainly. The point is that when you hear "local," you have to check separately what exactly is local.

The license isn't MIT either. It's PolyForm Noncommercial 1.0.0, with only earlier releases still under MIT. Evaluating and learning from it is fine; pulling the code into a commercial service isn't. Building your own version from the idea is unaffected.

What to check when something says "local"

If the file itself must not leave, like internal company footage, local is the right call. If many users are on low-end devices or the first screen has to appear fast, the server side is better.

One thing I couldn't pin down: the video preview was black (video.readyState = 0). The audio decoded and was transcribed, so the audio track was read. Whether it's the synthetic test video (testsrc2) or the app needs another look with real footage.

If you're weighing a feature that runs an AI model or WASM inside the browser, feel free to talk to negabaro. We start the same way as here: run it and see where it gets stuck.