Which Online Tools Upload Your Files - and Which Never Do

Almost every free tool site works the same way: you choose a file, it uploads to a server somewhere, software on that server does the job, and you download the result. The site you are reading is built the other way round - every tool here runs in your browser, and your files never travel anywhere. Both designs can be legitimate, but they are not equally private, and the difference matters most for exactly the files people most often push through these tools: a scan of an ID card, a payslip, a signed contract, a personal photo that needs shrinking for a form. This article explains how each design works, and gives you two tests to run on any tool site - including this one - so you never have to take a privacy claim on trust.

How most online tools actually work

On a typical converter or compressor site, the round trip looks like this: your browser sends the file to the company's server; the server runs the conversion with programs like ImageMagick or FFmpeg; the converted file is stored, briefly or not so briefly; and your browser downloads it back. Storage windows vary - some services delete files within an hour or two and say so plainly, others are vaguer, and a file passing through a server can also end up in logs, backups and abuse-scanning systems along the way. None of this requires the operator to be dishonest or careless; it is simply what server-side processing means. Your document existed, complete and readable, on a computer you do not control.

There are fair reasons to build tools that way. Servers are powerful, they handle enormous files and exotic formats, and the processing software already exists there. If you are converting a two-hour video or a 400-page scanned archive, a server is probably the right tool. The trade-off only becomes a problem when the file is sensitive and the job is small - which, for everyday tools, is most of the time.

The other way: the tool runs in your browser

Modern browsers are quietly capable of the same work. JavaScript can read a file you select into the tab's memory, draw images onto a canvas and re-encode them at a lower quality, generate QR codes, hash text with the Web Crypto API, and produce a download - all without a single request carrying your data anywhere. Our Image Compressor works exactly like this: the image is drawn to a canvas on your device and re-encoded there, and the "download" is generated locally too. When a tool is built this way, there is no upload to intercept, retain or breach, because the file never leaves the machine it started on. It also works on a plane, which is a decent clue, as the next section shows.

Check for yourself: two tests

• The network-tab test. Open the tool, press F12 (or right-click, Inspect) and go to the Network tab, then clear it. Now use the tool with a real file and watch what leaves your machine. A server-side tool shows a large request - usually a POST roughly the size of your file. A browser-based tool shows no such request: the file is never transmitted, though you will still see ordinary page and advertising requests.
• The offline test. Load the tool page fully, then disconnect completely - airplane mode, Wi-Fi off, cable out. Now use the tool. If it still does the whole job and produces your download, the processing is happening on your device by definition; there was nowhere for the file to go.

The honest part: free sites still run ads and analytics

Here is the part most "privacy-first" marketing leaves out, so we will not. A free site has to pay for itself somehow, and this one shows advertising; ad networks load their own scripts, and privacy-light analytics may count that a page was viewed. That is a real, if modest, flow of information about your visit - and it is completely separate from your tool input. The claim we make is narrow and specific: text you type, files you open, passwords you generate are processed in your tab and are not uploaded, stored, or placed in the page URL by these tools. You can read the detail on our privacy page, and the distinction is worth applying everywhere: "we may count page views" and "we receive your documents" are different claims, and only one of them should worry you about a payslip.

When a server tool is fine - and when to avoid one

• Fine on a server: public or non-sensitive files, huge media your device would struggle with, obscure formats that genuinely need specialist server software.
• Keep in the browser: ID and passport scans, payslips and bank documents, signed contracts, client or patient files under a duty of confidentiality, personal photos, and anything you would not email to a stranger.
• Either way: a shared or public computer is its own risk - downloads and browser history stay on the machine after you leave, whatever the tool did.

The underlying point is simple: privacy claims are cheap, but architecture is verifiable. A tool either sends your file somewhere or it does not, and with a network tab and an airplane mode you can tell which in under a minute. Prefer tools that never ask for the upload in the first place - and check, the way you just learned to, rather than trusting. All 30 tools on this site are built that way; start from the homepage and run the offline test on any of them.