Every converter on this site claims your files never leave your device. That claim is worth exactly nothing on its own — any site can type it. What makes it meaningful is that you can check it yourself in about three minutes, with tools already built into your browser. This page is the walkthrough.
The 3-minute check (Chrome, Edge — Firefox is near-identical)
- Open any tool page, e.g. HEIC → JPG.
- Press F12 (or ⌥⌘I on Mac) → Network tab. Check "Preserve log".
- Reload the page once, let it finish loading. Everything so far is the page downloading to you — HTML, CSS, the converter code, WebAssembly decoders.
- Now drop a real photo and wait for the download button. Watch the request list.
- Convert, then click download. Watch again.
What you should see during steps 4–5: nothing new, or only requests that are obviously not your file. What an upload would look like: a POST or PUT request, a request with a multi-megabyte "payload" size, or any request to an unfamiliar host right after you dropped the file.
| Request | Direction | Verdict |
|---|---|---|
| HTML / CSS / JS / .wasm on first load | Server → you | Normal — the tool downloading itself |
| blob: / data: URLs | In-memory only | Normal — never leaves the browser |
| /cdn-cgi/rum (Cloudflare beacon) | Timing metrics only | Disclosed in our privacy policy — inspect its payload: page URL and load times, no file data |
| google-analytics requests | Only if you clicked "Allow analytics" | Tool name and coarse buckets — documented; never file names, sizes or contents |
| Any POST/PUT with your file's size | You → somewhere | That's an upload. Leave the site. |
The automated version: enforced on every build
We run this same check as a machine, not a habit. Our end-to-end suite (85 checks at the time of writing — the count on every tool page's "last verified" line) drives a real Chromium through every conversion path with a network monitor attached. The rule it enforces: during a conversion, any non-GET request, or any request to a host other than this site, fails the build — the release doesn't ship. The suite also converts a file with the network disabled entirely (engines already loaded), proving the conversion has no server dependency.
What this can't prove — honest limits
- Our test proves our build; your check proves your session. A malicious site could upload only sometimes, or only after some interaction. That's exactly why the 3-minute check matters: it verifies the session you are in, not our promises.
- The strongest single proof is offline conversion: load the tool page, convert one file (this fetches the converter code), then switch to airplane mode and convert another. No network, same result — nothing to upload to.
- Browser extensions can inject their own requests into any page; test in a clean profile if you see traffic you can't explain.
Related reading: what happens to your metadata during conversion — the other half of the privacy story.