How to tell if a free online tool is uploading your file

You have a contract to convert, a photo to shrink, or a CV to build, and you search for a free tool. The first result says “100% secure” and “your files are deleted after one hour”. Both of those sentences are promises about a server — which means the file went to a server.

There is a different kind of tool that does the work in the page you already loaded and never sends the file anywhere. From the outside the two look identical. Here is how to tell them apart in about two minutes, without trusting anybody’s marketing, including ours.

The tell that costs nothing to check

Open your browser’s developer tools before you use the tool. In Chrome, Edge or Firefox that is F12, or right-click anywhere on the page and choose Inspect. Click the Network tab, then use the tool normally — pick your file, press the button.

Watch the list. You are looking for one thing: a row that appears at the moment you press the button, with a Size that is roughly your file’s size.

• If a row like that appears, your file was uploaded. Click it and look at the Request URL to see where it went.
• If nothing appears, or only tiny rows a few kilobytes in size, the work happened in your browser and the file never left your machine.

That is the whole test. It is not a clever trick — it is the browser telling you what it actually did, and a marketing claim cannot argue with it.

Two details worth knowing so you read it correctly. Analytics and ad scripts will still fire and produce small rows; those are the page measuring you, not your file leaving. And filter the Network tab to Fetch/XHR to cut most of the noise, though it is worth a glance at All too, because an upload can be disguised as an image request.

Why it matters more than it sounds

“The file is deleted after an hour” is a promise you cannot verify and which has nothing to do with what happens in the meantime. A file that reaches a server has been through somebody’s logs, somebody’s temporary storage, and possibly somebody’s backup. If you accept that, fine — but accept it knowingly.

Think about what people actually paste into free tools:

• An assignment before it is submitted. Some universities treat prior publication as a plagiarism problem, and “publication” can include an upload you did not think about.
• A CV, which is your phone number, your email, your address history and where you work now, in one convenient document.
• A client’s document under an NDA, converted at 11pm because the deadline is tomorrow. That upload is a breach whether or not anything bad happens next.
• A photo, which unless it has been stripped still carries the GPS coordinates your camera recorded when you took it.
• A password, pasted into a “check how strong my password is” box. If that box is not doing the work locally, you have just typed your password into somebody else’s server.

None of this requires anyone to be malicious. It only requires the file to have gone somewhere you did not intend and cannot see.

Why so many tools upload when they do not need to

Often it is not sinister, it is just older. Ten years ago the browser genuinely could not resize an image, read a PDF or generate a document, so everything ran on a server and that is how the tools were built. A lot of them have never been rewritten.

Sometimes it is deliberate for a reason that has nothing to do with you: a server-side tool can meter usage, gate a download behind a sign-up, and collect an email address. A tool that runs entirely in your browser cannot do any of those things, which is precisely why fewer of them exist.

And sometimes the file goes up because the site is a wrapper around somebody else’s API. The site you are looking at is not doing the work at all — it is forwarding your file to a third party you have never heard of and were never shown.

The four questions worth asking

The Network tab answers the main one. If you want a fuller picture:

1. Does it work with the internet off? Load the page, switch off your wifi, then use the tool. If it still works, nothing is being sent, and this is the most convincing test there is. (Fair warning: a page that has been designed to work offline will pass this whether or not it normally uploads. Combine it with the Network check.)
2. Is there a sign-up before the download? An account gate usually means a server, because the file has to be somewhere for the gate to be worth having.
3. Does the privacy policy name the tool specifically? A generic policy that talks about “our services” while the page promises files never leave your device is two teams who have not spoken to each other, and the lawyer’s version is the one that binds.
4. Is the result instant? A large image resized in under a second was resized locally. A progress bar that depends on your connection speed is a progress bar for an upload.

What we do, and how to check it

Every tool on this site runs in your browser: the image compressor, the CV maker, the invoice generator, the password generator, the word counter and the rest of the fifteen. None of them sends what you put into them anywhere, and a few keep a draft in your own browser’s storage so your work survives a refresh — on your device, readable only by you, and gone when you clear your browser data.

Do not take that on trust either. Open the Network tab and use any of them. The point of writing this is that you should not have to believe us, and the check that proves us right is the same one that would catch us out.

Our privacy policy says the same thing in the form that actually binds, including the parts that are less flattering: we do run Google Analytics, and Cloudflare sees your request because it serves the page. The files are the part that never move.

---

If you would rather have this done properly for your own product — tools that work in the browser, or an honest answer about when they cannot — that is what we build.