How to check whether a tool is really uploading your file
Privacy claims on file-tool websites are unverifiable marketing until you look. Looking is easier than you would think, and it works on any site — including this one.
6 min read · Updated
Private — processed on your device, never uploaded
Why the claim is worth checking
“Your files are deleted after one hour.” “We do not store your documents.” “100% secure.” These sentences appear on nearly every file-conversion site, including the ones that upload every byte you give them to a server you know nothing about, in a country you did not choose, for however long their actual retention policy says.
None of that is necessarily sinister. Server-side processing is a legitimate way to build these tools, and plenty of the companies doing it are careful. But a promise about what happens to your file after it arrives is a promise you cannot check, and for a contract, a payslip or a medical form, "trust us" is a weak position when the alternative is verifiable.
The thing you can check is far simpler than the retention policy: did the file leave your machine at all? That question has a definite answer, and your browser will tell you.
The one-minute check
This works in Chrome, Edge, Firefox and Safari, on any site, with no extensions. Use a file you do not mind uploading in case the answer turns out to be yes — a photo of a wall, or a PDF you generate for the test.
- Open the developer tools before you touch the fileF12, or Ctrl+Shift+I (Cmd+Option+I on a Mac). In Safari you first enable the Develop menu in Settings → Advanced. Go to the Network tab.
- Clear the log, and leave it recordingThere is a circle-with-a-slash button to clear. Everything the page requests from now on will be listed, with its size.
- Now drop in your file and run the toolDo the whole operation — pick the file, press the button, wait for the result.
- Sort the list by size, largest firstThis is the tell. If your 4 MB PDF was uploaded, there is a request in that list roughly 4 MB in size, with a method of POST or PUT. If the largest thing there is a few hundred kilobytes of JavaScript, nothing of yours went anywhere.
The stricter version
If you want to be sure rather than fairly sure, take the network away and see whether the tool still works.
- Load the page, then switch your browser to offline mode — in the Network tab there is a throttling dropdown with an Offline option.
- Now use the tool. A tool that processes files on your machine will work perfectly with the network off. A tool that uploads cannot, and will hang or error.
- For the strongest version: turn off Wi-Fi entirely after the page loads. Same test, no browser setting to trust.
This is the check we would encourage anyone to run on Toolpit. Load a tool, go offline, merge two PDFs. It works, because there is no server in the loop to lose.
Merge PDFA good one to try it on — pick two PDFs, go offline, merge them, download the result.What this does not prove
Being straight about the limits of the test matters more than the test itself.
- It shows your file was not uploaded during that run. It does not mean the site collects nothing — analytics, ad networks and error reporting are separate questions with their own requests in that same panel.
- It is a snapshot of the code served today. A site can change tomorrow. Re-running the check on anything you use routinely costs a minute.
- A page could in principle upload only some files, or only sometimes. Testing with a file like the one you actually care about closes most of that gap.
Toolpit shows ads, and ad scripts set cookies — you will see those requests in the panel, and our privacy policy says so plainly. What you will not see is your document, because there is no endpoint here that accepts one.
Questions
Can a website really process a PDF without a server?
Yes. Browsers have been able to read files, run compiled code through WebAssembly and write files back for years. The processing libraries are the same ones a server would use, compiled to run in the tab instead. The page downloads the library once; your file stays where it is.
Is a tool that uploads my file automatically unsafe?
No — plenty of server-side services are run responsibly. The point is that you are relying on a policy rather than on something you can check. For routine files that is often fine; for anything confidential, a tool that never transmits the file removes the question entirely.
Why do some private tools download a large file first?
That is the processing engine — usually WebAssembly, sometimes an AI model. It is the cost of doing the work locally, and it is cached after the first run. A large download followed by silence is exactly the pattern you want to see.
Private by design — your files never leave your device. If this was useful, passing it on is the whole marketing budget.