fundamentals · 6 min read
Browser privacy for file tools: how to tell where your file goes
A file tool that processes locally does the work in your browser tab: the file is read into memory, changed there, and saved through a download link, without a network request that carries its contents.
A server-side tool uploads the file, converts it on a machine you do not control, and returns the result. Both approaches can be honest, but the page should state which one it uses and what happens to uploads afterwards.
What local processing means in practice
When you choose a file, the browser exposes it to the page as a File object. A local tool reads it with the File API, transforms it using JavaScript, WebAssembly or a canvas, and creates a download from memory. The bytes never have to leave the device, and the conversion can keep working after you disconnect the network.
That does not make the page automatically trustworthy. The page's own scripts, and any browser extension with access to the tab, can read the file once it is open. Local processing removes the upload, not the need to use a site you trust, keep your browser updated and avoid extensions you do not recognize. Very large files can still hit memory limits in the tab, so a browser converter may slow down or crash rather than stream the data efficiently.
How to check what a tool actually does
Open the developer tools, switch to the network panel, clear the list, then select a file and start the conversion. A local tool loads code and fonts, but you should not see a request carrying the file itself. A server tool sends a POST, usually multipart, to an upload endpoint and gets progress events back.
The offline test is quick and hard to fake in the other direction: load the page fully, disable the network, and run the conversion. A local tool keeps working because its code is already in memory; a server tool fails because it cannot upload. Also watch the first conversion: an instant result on a large file suggests local work, while a progress bar and a wait suggest a server queue.
Server-side conversion and temporary storage
Some jobs genuinely need a server: video encoding, heavy OCR, large media conversions. That is a reasonable design, and the responsible pattern is well understood. The file is uploaded over HTTPS into a per-request temporary directory, processed, returned, and deleted automatically, with no long-term copy and no human review.
A clear policy states the upload limit, how long files and results are kept, whether anything is logged, and which third parties touch the data. It should also say whether uploaded content is used to train models, which should be a plain no for a conversion utility. If a site cannot answer those points, treat the service as unsuitable for anything confidential.
Self-hosting changes the question from which company sees the file to which machine does. Open-source converters that run on your own computer or server are often the best answer for regulated work, because the retention rules are whatever your own infrastructure enforces. If you cannot self-host, ask whether the service offers a business plan with a data processing agreement rather than relying on a consumer policy.
Reading a privacy claim critically
Specific claims can be checked: converted in your browser and never uploaded, deleted immediately after the response, no account required. Vague assurances cannot. Phrases such as military-grade encryption or one hundred percent secure are marketing, and encryption in transit is simply what HTTPS provides on any competent site.
Advertising and analytics are a separate question from file handling. A local converter can run analytics without ever seeing a file, and a site with no ads can still upload everything. Judge the two independently, and remember that a privacy policy describes current practice, not a promise for next year. A dated policy and a working contact route are small signs that someone actually maintains it.
Safe habits for sensitive files
For identity documents, medical records, contracts, payslips and client material, prefer a local tool, and preferably one that still works after you disconnect the network. Use a browser profile without unknown extensions, check the address bar carefully, and be wary of a one-off conversion that suddenly needs an account or an email address.
- Keep the original file and delete downloaded copies you no longer need.
- Turn off the network after the page loads when you want to prove local processing.
- Never paste passwords, tokens or private keys into a page that merely claims to be private.
- Read the retention wording before uploading anything you would not email to a stranger.
- For the most sensitive work, use offline software or a self-hosted tool.