Is this website uploading my file? How to check in ten seconds

The short answer

Two file tools can look identical in your browser. One does the work on your own computer. The other quietly copies your file to a computer somewhere else, does the work there, and sends the result back.

There is a ten-second test that tells you which one you are using, and it works whatever the page claims about itself. Load the page. Do the job once. Then turn your wifi off and do it again.

If it still works with the wifi off, your file was never sent anywhere. It could not have been. If it stalls, or the bar sticks at 40 percent, or you get an error, then your file was on its way to somebody else.

Most of what people put through these tools is dull, and then some of it is not. A passport photo. A payslip. A letter from a hospital. Those are the ten seconds worth spending.

Why you do it twice

The first run matters. A page often fetches the part that does the actual work only when you first ask for it, so a tool can fail with the wifi off simply because it never got the chance to load. Most tools work this way, including the ones on this site.

So do it in this order. Convert one file normally. Turn the wifi off, or put your phone in airplane mode. Convert another. The second run is the one that answers the question, because a tool that still works offline cannot be sending your file anywhere.

What "in your browser" actually means

Your browser can do a lot on its own now. It can resize a photo, read a PDF and zip up a folder without asking any server for help. When a page works that way, your file only ever exists in your own computer's memory. It is never sent, so there is nothing for anyone to keep.

The other way is older and much easier to build. The page uploads your file, a server does the work, and the result comes back down. It is still an upload when the page never uses the word, and when it is over in half a second.

Work done in your browser

Your file only ever exists in your own computer's memory.

1. You choose your file
3. Your browser does the work
5. You save the result

Your file is never sent.

Work done on their server

Your file is copied to a computer you will never see.

1. You choose your file
2. leaves your computer
3. Uploaded to their server
5. Their server does the work
7. The result is sent back

Your file leaves your computer.

Downloads are not uploads

Here is the part that trips people up, and that a lot of privacy pages get wrong.

A tool that works entirely in your browser is not a page that sits in silence. It still has to fetch itself: the page, the type, the code that does the compressing, often only when you first press the button. Most sites also fire off a small request so somebody knows the page was visited. This site does both.

All of that is data coming in, towards you. An upload is data going out, away from you, and for your file that is the only direction that matters. So the honest claim is never "this page makes no network requests", still less "the network tab stays empty". It is narrower, and much stronger:

Your file is never sent.

• Coming inNot your file

  The page, the type it is set in, and the code that does the work

• Going outa few hundred bytesNot your file

  A visit counter: the name of the page, and a rough idea of which browser you are using

• Going outabout the size of the file you choseThis is the upload

  Your file, on its way to their server

Hold on to that difference if you go looking in your browser's Network tab. Ignore everything coming in. You are looking for one request sending data out that is roughly the size of the file you chose. That request is the upload. A tool that does the work in your browser has none.

Five signs a tool is sending your file somewhere

• "We delete your files after one hour."

  Read that again. It is honest, and it is telling you the files arrive in the first place. A tool that works on your computer has nothing to delete.

• A progress bar with a percentage and a speed.

  Work done on your own computer has no transfer speed to report.

• An account, or your email address, before it will do anything.

  Ask why a one-off conversion needs to know who you are.

• A size limit with an upgrade offer next to it.

  A cap like that is usually about somebody's storage bill rather than your browser.

• "Your files are encrypted in transit."

  True of almost every website, and beside the point. It describes the journey, not the destination.

Is it safe to use an online file converter?

Some are and some are not, and it is one question either way: does the work happen on your computer or on theirs? A tool that never sends your file cannot lose it. A tool that does is asking you to trust a company you had not heard of an hour ago.

Nobody has to be out to get you for this to matter. It only takes a copy sitting on a computer you cannot see, for as long as their systems happen to keep it. Breaches are rarely aimed at anyone in particular.

Before any of it, though, check whether you need a tool at all. Plenty of these jobs turn out to be a rename, or a setting already on your phone. A tool you did not have to use is the safest one there is.

Better than a promise: a list your browser enforces

A privacy page costs nothing to write. There is something stronger a tool can do, and you can check for it in a few seconds.

A page can arrive carrying a short list of the only places your browser is allowed to send anything. Your browser holds the page to that list. Whoever built the page does not.

So when no server that could do the converting appears on the list, a mistake in the tool's own code cannot put your file on somebody else's computer. Your browser blocks it before it leaves, and nobody at the other end can overrule that.

Plenty of tools carry no such list, or one wide enough to allow almost anything. Reading one takes nothing but the browser you already have, and the end of this page shows you how, with this site's own list as the example. None of it exempts the tools here from the wifi test, so run that on them too. The privacy page covers what else they do and do not do.

Common questions

Is it safer to use an app than a website? Not by itself. An installed app can send your file somewhere just as easily, and it can usually see more of your computer than a web page can. The question does not change: where does the work happen?

What does it mean when a tool says it is secure? Usually that the connection is encrypted, and that they follow rules about the files they hold. Both can be true of a tool that keeps a copy of everything you send it. It is a promise about handling, not about whether they have your file at all.

Are paid tools safer than free ones? Paying changes who covers the storage bill, not where the work happens. Some paid tools upload everything and some free ones upload nothing. Run the test either way.

Can I check a tool without turning my wifi off? Yes, and the rest of this page shows you how. Your browser can show you every request a page makes, and there is a response header that is stronger still.

---

Want to be sure? Check it yourself

Everything above is enough for most people, and the wifi test is the one to remember. What follows is for anyone who would rather look than be told. It needs nothing but the tools already built into your browser.

Chrome and Edge

Open

F12, or right-click and choose Inspect

Panel

Network

Filter

method:POST

Shows what was sent

the Payload tab

Firefox

Open

Ctrl+Shift+E, or Cmd+Option+E on a Mac

Panel

Network

Filter

method:POST

Shows what was sent

the Request tab

Safari

Open

Cmd+Option+I, once you have turned the tools on

Panel

Network

Filter

none: read the Method column instead

Shows what was sent

not in full, so check in Chrome or Firefox

Chrome and Edge

1. Press F12, or right-click the page and choose Inspect.
2. Click the Network tab. It only records while it is open, so open it before you convert anything.
3. Convert your file.
4. Type method:POST into the filter box. A file on its way out almost always leaves as a POST, so if nothing appears at all, nothing was posted.
5. If a row does appear, click it and open its Payload tab. That tab is what was sent: your file, if it went, is in there, usually as a form field still carrying its name.

One trap. The Size column measures what came down, not what went up, so a large upload can sit on a row reading a few hundred bytes. Trust the Payload tab instead. Edge uses the same developer tools as Chrome, so every step above is identical.

Firefox

1. Press Ctrl+Shift+E, or Cmd+Option+E on a Mac, to open the Network panel directly.
2. Convert your file. This panel also records only while it is open.
3. Type method:POST into the filter box, which works here too.
4. Select any row it leaves you with and open the Request tab to see the body that was sent.

Safari

1. Open Safari's settings, then Advanced, and tick "Show features for web developers". Older versions call it "Show Develop menu in menu bar".
2. Press Cmd+Option+I and choose Network.
3. Convert your file.
4. Safari has no method: filter, so read the list's Method column instead. Right-click the column headings to add it if it is missing.
5. Look for anything that is not a GET.

Safari's request detail is coarser than the other two, so to see exactly what a request carried, run the same check in Chrome or Firefox.

One honest limit on all three: no POST is very good evidence, not proof. A determined site could send a file in pieces, or over a connection that never appears as a plain POST. That is why the wifi test comes first, and why the next part exists.

The strongest check: a header that makes the browser refuse

Everything so far is you watching. This one is your browser refusing.

A site can serve every page with a Content-Security-Policy header: a list, written by whoever built the site and enforced by your browser, of the only places that page is allowed to send anything. The line that starts connect-src is the one about sending data. When it names no server that could do the converting, no code on that page can post your file to one, however the code was written and whatever anybody intended.

To read it on any page, open the Network tab as above, reload, click the very first row (the page itself), and look under Response Headers for content-security-policy. Or, from a terminal, with any address in place of this one:

curl -sI https://toolmigo.com/ | grep -i content-security-policy

Many sites send no such header, and plenty send one wide enough to permit almost anything. A narrow one looks like this. It is the line this site ships, in full, exactly as it arrives:

connect-src 'self' data: blob: https://scripts.simpleanalyticscdn.com https://queue.simpleanalyticscdn.com

In plain terms, that is three kinds of thing:

• 'self' is toolmigo.com and nothing else.
• data: and blob: are not somebody's computer at all. They are handles to data already sitting in your own browser's memory, which is how a page hands your photo to the code that resizes it. Nothing can travel out through them.
• The two simpleanalyticscdn.com addresses are a visit counter: the one entry on the list that does leave your machine. It sends the name of the page and a rough idea of which browser you are using. A few hundred bytes, cookieless, and never your file.

That is the whole list. No conversion server, no storage bucket, no third party, because anything not named there is refused by your browser rather than by anybody's good intentions.

Read the same line on the next file tool you try. If it allows some server you have never heard of, that is somewhere your file can go.

Two honest limits here as well. Your browser is what enforces this, so on a browser old enough to ignore the header it buys you nothing; every current one honours it. And a list of allowed destinations is not a claim that nobody writes bugs. It is the narrower, more useful claim: a bug cannot put your file on somebody else's computer.

If you remember one thing

Load the page. Turn the wifi off. Try again. If it still works, your file was never sent.