Why browser tools do not upload your files, and how to check in a minute

Two ways to build the same tool

Take something simple: resize an image to 1080 × 1080. There are two architectures, and they look identical from the outside.

Server-side. Your browser uploads the file. A server resizes it and sends the result back. Your image existed, however briefly, on a machine you do not control — and it may exist in a request log, a temporary directory, a backup or a CDN cache long after you closed the tab.

Client-side. The page contains code that can resize images. Your browser reads the file from disk, draws it to a canvas, and hands you the result. The file never becomes a network request, because there is nothing to send it to.

Both give you a square image. Only one of them ever had your photograph.

What makes client-side possible

Browsers have quietly become capable of most of what these tools need:

• FileReader and object URLs read a file you choose, without uploading it.
• Canvas decodes, scales, crops and re-encodes images, with a quality setting for JPEG and WebP.
• Web Crypto generates cryptographically strong random values and computes SHA hashes natively.
• Intl formats dates, numbers and currencies for every locale, with the timezone database already included.

None of that needs a server. A password generator that calls an API is not just slower and less private — it is worse, because the password existed somewhere else before it reached you.

How to check, in about a minute

The Network tab

1. Open the site, then open your browser's developer tools (F12, or Cmd+Option+I on a Mac).
2. Select the Network tab and clear it.
3. Now use the tool — paste your text, choose your file, press the button.
4. Watch the list.

If the tool runs locally, nothing new appears. If something does appear, click it and look at the request payload: that is your data, and now you know where it went. This works on any site, not just this one, and it is the single most useful thing to know how to do about web privacy.

The offline test

Even simpler, and harder to fake. Load the page, turn off your Wi-Fi, and keep using it. Tools that run in your browser keep working with no network at all. Tools that need a server fail immediately.

What a website still sees

“Nothing is uploaded” is a precise claim and it is worth being precise about what it does not cover. Even a site that collects nothing is served by a host, and delivering a page requires knowing where to send it. The host's logs will record your IP address, the time, which page you asked for and which browser asked. That happens before any of the site's own code runs.

Beyond that, most sites add things that do collect data: advertising, analytics, embedded fonts, chat widgets, comment systems. Each one is a third party your browser contacts on the site's behalf. This is why a cookie policy that lists the actual services is more useful than a privacy page that only makes promises — you can check the list against your own Network tab.

How to judge any free tool site

• Does it work offline? The fastest signal there is.
• Does it insist on an account for something that does not need one? An email address is the product being collected.
• Is there a file size limit? Limits usually mean uploads, because the constraint is bandwidth rather than your own memory.
• Does the privacy policy name specific services, or does it speak in general reassurance? Specifics can be verified.
• Is there a queue or a progress bar for something instant? Local work does not queue.

None of this requires trusting anybody, which is the point. A claim you can check in sixty seconds is worth more than a policy you have to believe.