Private LLM token counting for enterprise prompts, files, and code

Token budgeting creates an awkward enterprise problem: the material that needs measuring is often the material a team is least willing to upload. System prompts can encode internal policy, source files can contain proprietary logic, and reports or datasets can carry regulated or commercially sensitive information.

The token-counter disclosure problem

A text-only counter solves only the simplest workload. Real AI requests are assembled from instructions, retrieved document passages, repository files, structured data, and images. Sending those inputs to a separate counter creates an additional processor and disclosure path before the material even reaches an organization's approved AI system.

TokenCalculator.dev removes that extra content transfer from the preflight step. One hundred percent of submitted prompt, document, code, data, and image content stays in the active browser session during calculation.

How browser-local counting works

The calculator is delivered as a web application, but the sensitive workload executes locally. Text encoding, document extraction, image-dimension inspection, model-rule selection, aggregation, context-fit calculation, and price multiplication run in browser JavaScript and a Web Worker. The server delivers application assets; it does not receive the calculation payload.

OpenAI-family raw text uses a locally loaded BPE rank vocabulary. Claude, Gemini, and DeepSeek text results use a clearly identified provider-calibrated UTF-8 projection because their production tokenizers are not presented as locally available exact encoders. This preserves privacy without misrepresenting estimation accuracy.

What can be measured without uploading it

• Private prompts: system instructions, agent policies, few-shot examples, and user-message templates.
• Documents: readable PDF and DOCX files are parsed in the browser; scanned PDFs require OCR and are rejected rather than assigned a fabricated count.
• Source code: common JavaScript, TypeScript, Python, Go, Rust, Java, C/C++, HTML, CSS, SQL, shell, and configuration formats are decoded as text without summarization.
• Structured data: JSON, CSV, XML, YAML, TOML, logs, and other readable payloads preserve their punctuation, keys, identifiers, and whitespace for counting.
• Images: dimensions feed provider-specific tile, patch, resize, detail, and cap formulas; the pixels are not uploaded to a model.

This supports repository-review planning, document-batch estimation, RAG chunk design, contract or report analysis, image-processing budgets, and context-window checks without reducing every workflow to pasted prose.

How an enterprise reviewer can verify the boundary

1. Open browser developer tools and select the Network panel.
2. Use a synthetic prompt and sample file—not confidential production data—for the test.
3. Run the calculation and inspect request payloads. Public asset, analytics, and pricing-metadata requests can occur, but no request should contain the submitted content or result.
4. Reload the page and confirm the active workload is gone.
5. Review the privacy architecture, calculation methodology, and organizational browser controls before approving a workflow.

What “privacy-first” does and does not promise

Browser-local content processing does not make a public website air-gapped, certify regulatory compliance, or override endpoint monitoring and browser extensions. It also does not observe provider-added system tokens, tool schemas, OCR, retrieval wrappers, or final billed usage. The value is specific and substantial: confidential input does not need to be disclosed to a separate token-counting backend.

For production cost reconciliation, validate a non-sensitive representative workload against the approved model provider's token-count endpoint or response usage fields. Read why the local token count and API bill can differ.