Free tool · Your logo never leaves this page

A starter kit for the
system around your mark.

Last verified:

A logo is one window into your brand — not the whole frame. Drop yours in; Brand Suite extracts a palette, grades every pair against WCAG, and hands you CSS tokens and a starter README. Built in the browser, by the studio. Your pixels never touch a server.

Stays in your browser. See how we verified it

From Muntin Digital — a one-person restaurant web studio in Silver Spring, MD. The window in.

Drop your logo, or click to select PNG, JPG, WebP, SVG, or iPhone HEIC · stays in your browser · nothing is uploaded

Not sure what to upload?

Or, if you don’t have a logo handy:
Plain English

What this does, in four sentences

  1. You drop a logo. Your browser samples the pixels into a small grid — the file itself never leaves your device.
  2. You get a five-color palette. The colors are pulled from your logo by a clustering algorithm that runs in the page, sorted into roles (Primary, Secondary, accents, Neutral) by chromatic intent.
  3. You get accessibility math. Every pair gets a WCAG contrast grade, and each color comes with a slightly-shifted “accessible pair” that’s safe to use as text on cream or ink.
  4. You get four ways to take it with you. The Muntin Pane is a single shareable PNG. The CSS variables paste into a stylesheet. The tokens.json drops into Figma. The ZIP packages all of the above plus a README.

It is not a logo generator, a finished brand identity, or a typography recommendation. More on the limits below.

Lead by example

How we protect the logo you upload

A logo in progress is sensitive: it might be a rebrand you haven't announced, a concept you haven't shown a partner, a finished mark you paid real money for. Nine claims. Each is verifiable in your own browser in under a minute. If any of them turn out to be wrong, we want you to find out first.

Verify the claim yourself · for developers

Your logo never leaves this page.

No fetch(), XMLHttpRequest, FormData, or form submit fires when you drop a file. The browser reads the pixels via URL.createObjectURL() and paints them onto a canvas — everything after that is client-side.

Inspect this
Open DevTools (Cmd+Opt+I / Ctrl+Shift+I) → Network tab. Drop a logo into the upload zone above. The request list should not grow. If it does, that's a bug — tell us.

There's no server to upload it to.

The only endpoint this page uses is GET /tools/brand-suite/. No /api/brand-suite-upload, no /api/extract-palette, no logger. The Worker can't hear you.

Inspect this
From a terminal: curl -X POST https://muntin.digital/tools/brand-suite/. Response: 405 Method Not Allowed (or similar) — there's nothing listening for POSTs.

Analytics sees only buckets, never pixels or filenames.

Plausible receives properties from a short, fixed list of enumerated values. A 1.3 MB PNG becomes file_type: "png" + size_bucket: "500kb-2mb". A teal logo becomes primary_hue: "teal". Your raw hex values, filename, and bytes are never a value on any event.

Inspect this
DevTools → Network → filter plausible. Drop a logo; extract a palette. When the event fires, look at its payload. Values like primary_hue: "teal" — never primary_hex: "#1F4E5B", never filename: "client-draft-v7.png".

No cookies, no localStorage, no IndexedDB — for image data or derived colors.

The pixel array and the extracted palette live only in JavaScript variables, which disappear when you close the tab. There's no persistent state for the tool.

Inspect this
DevTools → ApplicationStorage. Upload a logo; extract a palette. Check Cookies, Local Storage, Session Storage, IndexedDB for this origin — the panels stay empty of any image data, any hex value, any filename.

No third-party scripts touch the pixels.

This page loads three same-origin JavaScript files: site-wide site.js (nav + language switch), tool-specific brand-suite.js (math + UI), and brand-worker.js (the Web Worker that runs k-means off the UI thread). Plus one analytics script (Plausible) that receives the bucket values. Nothing else — no Google Tag Manager, no Meta Pixel, no chat widget, no session replay, no CDN-fetched dependencies. The ZIP writer is inline in this page's JavaScript; it isn't a third-party library.

Inspect this
DevTools → Network → filter JS. Reload then drop a logo. You should see plausible.io/js/…, site.js, brand-suite.js, and brand-worker.js. That's it.

Outbound links can't leak what you opened.

This page sets <meta name="referrer" content="no-referrer">. When you click a link out of Brand Suite (to the glossary, to a blog post, to the services page), the destination never sees the URL you came from — so even if we added a "save this palette" share link later (encoded in the URL fragment), no third party could harvest it via the Referer header.

Inspect this
View source on this page. Find the line <meta name="referrer" content="no-referrer"> in the <head>. Click any outbound link; confirm the destination's Referer request header is absent.

The source is readable.

No build step, no minification, no framework. The math module is plain JavaScript — you can read every line, including the 50-line ZIP writer we inlined instead of pulling in a 100 KB dependency.

Inspect this
Right-click this page → View Page Source. Or open /tools/brand-suite/brand-suite.js directly. Search for function extractPalette — that's the whole k-means, in the open. Search for buildZipBlob in this page's <script> — that's the ZIP writer.

Nothing persists beyond this tab.

Close the tab, reopen the tool: the upload zone is empty, the palette strip is blank, the contrast grid is hidden. There's no account, no saved history, no "welcome back, here's your last logo."

Inspect this
Upload a logo, generate exports, download the ZIP. Close the tab. Reopen /tools/brand-suite/. Every surface is back to its starting state.

The Web Worker that clusters your pixels has no network access.

Clustering runs in brand-worker.js — a Web Worker loaded from the same origin. Its only inputs are the pixel array we pass via postMessage and the k value. It imports only ./brand-suite.js (same origin), and our code never hands it a fetch, a socket, or any network primitive. The worker dies when the tab closes.

Inspect this
Open /tools/brand-suite/brand-worker.js directly. The whole file is under 60 lines — count the fetches, XHRs, and WebSockets. You'll find zero.
Apply this anywhere

How to check if any tool is safe

Five tests you can run on any free creative tool — palette extractor, logo resizer, brand-mood generator, favicon builder — before you upload a work-in-progress mark. We score ourselves alongside a typical lead-generation free tool so the difference is concrete, not rhetorical.

The test Brand Suite Typical free tool
1. Does uploading a file trigger a network request?Open DevTools → Network. Drop a file. No requests fire. The file POSTs to a server the moment you drop it.
2. Is the privacy claim at the point of upload?Not buried in a policy page. "Stays in your browser" badge next to the dropzone, full 9-step panel in-page. Privacy Policy link in footer only; implicit consent on submit.
3. Is there an account / newsletter / cookie gate?Anything demanding "accept all" before you can use the tool. Nothing — no gate, no popup, no cookie banner. "Enter your email to unlock your palette."
4. Any third-party analytics, session replay, marketing scripts?DevTools → Network → filter JS. Privacy-first Plausible only; bucket props (never hex values, never filenames). Google Analytics, Meta Pixel, HubSpot, session replay — stacked.
5. Is the source code readable?Right-click → View Source. Unminified, under ~600 lines, every math function + the ZIP writer named. Minified SaaS bundle; math hidden inside a framework dashboard.

Apply the same five tests to any creative-workflow tool that asks for an upload — logos, photos, invoices, contracts, ID scans. A tool that silently POSTs your file is storing it. A tool with no in-page privacy claim is dodging the question. You're allowed to walk away before you drag anything in.

What to share, where

Four tiers of your business data

Not every asset belongs in every conversation. A logo in progress is mid-tier — more sensitive than a public menu, less sensitive than a tax ID, but routinely handed over to free tools as if it were Tier 1. Four tiers, each with a different audience and a different level of caution. Your brand assets usually live in Tiers 1–2.

Tier 1

Public

Everything anyone can find on your site, your listing, or a walk-by — including any logo already in the wild.

  • Published logo on your sign, site, menu, social profiles
  • Menu, hours, photos, address, phone
  • Schema.org markup, cuisine tags, service attributes

Share with: Anyone. Optimize aggressively — this is how customers find you.

Tier 2

Competitive-sensitive

Legal to share, but useful to a rival — or leverage for a platform. Most in-progress brand work lives here.

  • Unreleased logo drafts, rebrand concepts, unfinished wordmarks
  • Cost of goods, supplier list, negotiated pricing
  • Commission tier you actually pay (not the public rate)
  • Labor schedule template, daypart mix, menu-engineering matrix

Share with: Designer, bookkeeper, consultant, broker — under NDA. Not platforms, not competitors, not "free tools" that keep your upload.

Tier 3

Operational-confidential

Your actual operating numbers, customer pipeline, employee details.

  • Monthly P&L, actual food cost %, actual margins
  • Reservations pipeline, customer database, loyalty data
  • Employee names, schedules, tipped-employee distributions

Share with: Inside the business only. POS vendor, payroll processor, accountant — and only under a written contract that specifies what they can and can't do with it.

Tier 4

Regulated

Legally protected. Losing this has fines, lawsuits, or criminal exposure attached.

  • SSN, EIN, other tax identifiers
  • Customer card data (PCI scope), employee bank details
  • Food-safety logs, health-department correspondence, liquor-license status, I-9s

Handle with: Encrypted storage, access logging, contracts with cybersecurity terms. Never email. Never in a shared spreadsheet. If a vendor asks for this casually, that alone is a flag.

Apply this anywhere you're asked to hand data over — vendor evaluations, contracts, loan applications, "free audit" intakes. The pattern: data never flows up a tier. A Tier 3 vendor doesn't get Tier 4 access just because they asked. A Tier 1 audience (a platform, a listing site, a competitor) doesn't get Tier 2. The easiest way to reduce your attack surface is to stop volunteering data that wasn't actually required.

Honest framing

What this isn't

Brand Suite is a starter kit — it extracts colors from a logo you already like and grades the accessibility math. It doesn't build the brand. These limits are load-bearing, not decorative: a free tool that quietly claimed otherwise would waste your time and undercut our studio's actual work.

Not a logo design tool.

Brand Suite reads a logo you already have. It will not draw a new mark, fix a kerning issue, or turn a phone photo of your sign into a vector. If you don't have a logo you're happy with yet, the palette extraction will reflect that — garbage in, garbage out.

Not a monochrome or variant generator.

A finished identity needs a one-color version for embroidery, foil, and small-scale print — and often an inverted variant for dark-ground layouts. Brand Suite doesn't produce those in v1. A designer does it properly.

Not a typography pairing.

The preview uses our site's fonts for context, not a recommendation. Typography pairing is the second-biggest tone carrier after color; guessing at it algorithmically produces results that all look the same. Curated work, not a heuristic.

Not a usage-guidelines document.

The README in the ZIP names each color's role and its accessible pairs. It doesn't cover clearspace, minimum sizes, misuse examples, voice, photography direction, or the other chapters of a real style guide. Those are what the paid identity service delivers.

Not a mockup or a finished website.

The live-preview block shows the palette applied to one sample card. It's a legibility check, not a portfolio piece. Business cards, menu covers, Instagram grids, storefront signage — those are design projects, not one-click exports.

What this is: a starter kit to think with.

Three audiences, three handoffs, one free tool. Bring the Muntin Pane to a designer — it shows your palette in context on a single page. Bring the CSS variables to a developer — they paste straight into a stylesheet. Bring the hex codes to a printer or signmaker — that's the language of every print spec sheet. The Pane is the file a non-technical reader can actually share; the rest is for the people building things for you.

When you want a finished identity, hire a designer.

A Brand Identity engagement covers the concept work, the usage rules, the variants, the typography, and a deliverables package you can hand to any vendor. Bring the Muntin Pane, the palette, and the tokens you generated here — that's 30 minutes of the engagement already done.

See Brand Identity (from \$1.5k)