Do online converters upload your files?

You drop a contract, a scan of your passport or a family photo into a free converter, and a moment later you download the result. What happened in between is usually invisible. Either the file travelled to a server you know nothing about, or the page did the work on your own computer. Here is how to find out for any site, and what we saw when we checked our own.

Two kinds of online converter

• Upload and convert. The page sends your file to the company's servers, converts it there and offers the result for download. This is how most converters work, because servers can run any software.
• Convert in the browser. The page downloads the converter itself, compiled to WebAssembly or using the browser's own video, image and graphics engines, and runs it on your device. The file is read from your disk into the page and never sent anywhere.

The second kind became practical only in the last few years, as browsers gained fast WebAssembly, access to hardware video encoders and the graphics card. Tooloat is built that way, and so are a growing number of other tools.

Why it matters

An uploaded file is a copy on someone else's computer. Many upload-based services promise to delete files after one to 24 hours, and many of them surely do, but you cannot check. In the meantime the copy can sit in backups and logs, be handled by the service's hosting and storage providers in other countries, and be exposed if the service is breached. For a meme that does not matter. For an ID card, a medical letter or a contract under a confidentiality agreement, it may.

Policies also differ in what they allow. Some services reserve the right to use uploaded content to improve their products. That is worth knowing before you upload, and easy to miss in a long privacy policy.

How to check any site in a minute

Watch the network

1. On a computer, open the converter in Chrome, Edge or Firefox and press F12 (Cmd + Option + I on a Mac). Open the Network tab.
2. Click the clear button so the list is empty, then convert a test file, ideally a large one, so its upload is easy to spot.
3. Look at the Method column, or filter by Fetch/XHR. Downloads of code and pictures use GET. Uploads use POST or PUT.
4. Click any POST or PUT request and open its Payload tab. If you see your file's name, or a request whose size is close to your file's, it was uploaded.

Go offline

Load the converter and run it once with a harmless test file, so the page has downloaded everything it needs. Then disconnect: turn on airplane mode, unplug the cable, or pick Offline in the throttling menu of the Network tab. Convert again. If it still works, the page cannot be sending your file anywhere. If it fails, that does not prove an upload, since some tools fetch extra code for some files, but it is a reason to check the network.

What we saw on our own site

We opened the image compressor on tooloat.com in a fresh browser tab, added a 7.6 MB PNG and compressed it to fit 500 KB. It came out at 480 KB. These are all the requests the tab made, from opening the page to downloading the result:

Our pages also show a counter in the top bar, "Files: 0 B sent". It wraps the functions a page can use to send data, such as fetch, XMLHttpRequest, sendBeacon and WebSocket, and adds up the bytes of every request body. It stayed at zero for the whole test. Clicking it shows the details, including what Google's ad code sends to its own servers, which is counted separately from the tools.

You do not have to take a counter on our page on trust, which is the point of the steps above. The Network tab of your browser sees everything the page sends, whatever the page itself claims.

Things to keep in mind

• In-browser tools still download code. The first visit fetches the converter, and some tools fetch extra engines of several megabytes. That is data coming to you, not going out.
• One site can mix both. A preview may be made in the browser while the full conversion runs on a server, or one tool on a site may upload while another does not. Check the tool you use.
• Browser extensions can read pages. An extension with access to all sites can see files you open in a web page, whatever the site does. Use a private window without extensions for sensitive files.
• Phones are harder to check. Mobile browsers have no Network tab. Check on a computer, or use the offline test.