I built Image to Quiz in August 2026 to solve a problem I kept running into: turning printed worksheets and study material into digital quizzes meant retyping everything by hand. The app does that part for you. Upload photos of the material and it produces a Word document with the questions typed out, ready to print or share.
The whole interface is in Indonesian, because that's who I made it for. Parents, teachers, and students who work with printed material every day. The exported document uses 14pt text, which is comfortable for kids to read.
The first version went live on August 9, and the second release followed four days later. The gap was mostly fixes from real usage: privacy mode breaking the session handshake, two dependency vulnerabilities, and a batch of UX details like paste support and a proper loading state on the export button.
🚀 Features
- Photo upload: drag and drop, or paste with Ctrl+V. Multiple pages can be processed at once into one document.
- AI transcription: Gemini reads the questions and instructions from each photo and types them out. Important images, like diagrams, are cropped and saved automatically.
- Word export: the result downloads as a
.docxfile with 14pt text. The document printer only loads when the export button is pressed, so it doesn't slow down the rest of the app. - Status feedback: the app shows how many photos are picked, hides unsupported file formats instead of rejecting them, locks the photos while processing, and shows a clear message when something goes wrong.
🤖 The AI Part
The AI reads the sheet and transcribes the questions, but I didn't trust it blindly. Photos can contain hidden instructions, like "ignore your instructions" text baked into the image, so the AI is explicitly told to ignore anything like that. If the model returns something outside the expected format, it still renders cleanly instead of crashing to a white screen.
🔒 Privacy and Abuse Protection
Photos are never stored. GPS data is stripped from every image before it's processed, and nothing is written to a server.
The API is protected against abuse:
- Rate limits shared across all server instances, so hopping between machines doesn't help. The counters live in Netlify Blobs, which every instance reads.
- Session signatures that expire after 15 minutes and only work on one device.
- Origin checks on every request and a blocklist for automated tools.
- Oversized uploads are rejected before they're processed.
📸 Screenshots
