How to Tell If a Website Uploads Your Files (A 30-Second Test)

Every free online tool that handles your files makes the same promise somewhere on the page: your data is safe, your files are deleted, nothing is stored. You have no way of knowing whether any of that is true — unless you check. And checking takes about thirty seconds.

This is the method. It works on any website, including this one. Especially this one, because we make the claim louder than most.

The short answer

Both tests are below in detail, along with the part most guides skip — what a clean result does not prove.

Why this is worth thirty seconds

In March 2025 the FBI’s Denver Field Office issued a public warning about free online file converter tools. The detail that makes it nasty: the tool usually works. Your document converts, you download it, nothing looks wrong. Meanwhile the site has scraped the original file, and the thing you downloaded may carry malware.

The FBI listed what was being harvested — Social Security numbers, dates of birth, phone numbers, banking details, cryptocurrency information, email addresses and passwords. It was covered by BleepingComputer, Malwarebytes, Forbes and CSO Online, and the sites are still operating in 2026.

Now think about what people actually feed these tools. A passport scan for a visa application. A payslip for a rental deposit. Medical paperwork. A signed contract. An ID photo squeezed down to fit a government portal’s 50 KB limit. Those are exactly the files worth stealing, and the moment of upload is the moment they stop being yours.

Test one: the offline test (30 seconds, no technical knowledge)

This is the one to use if you only ever run a single check. It requires no understanding of how browsers work.

1. Open the tool page and let it finish loading. The page itself has to download — that is fine and expected. Wait until it is fully loaded and ready.
2. Disconnect from the internet. Turn off Wi-Fi, or unplug the ethernet cable, or switch on aeroplane mode. Do not refresh the page afterwards.
3. Use the tool. Add your file, set whatever options it offers, and run it.
4. Look at the result. If you get the correct output — a converted file, a compressed image, a word count — the work was done on your device. It could not have been done anywhere else, because there was nowhere for the file to go.
5. Reconnect. That is the whole test.

Use a junk file for this, not the passport scan. You are testing the architecture, not processing anything real.

Test two: read the network log

This one shows you exactly what left your machine. It is the version to run if you want to be thorough, or if you are going to tell other people what you found.

1. Open the tool page. Let it load fully.
2. Press F12. On a Mac, Cmd + Option + I. This opens developer tools — it is built into Chrome, Edge, Firefox and Safari, and you cannot break anything from it.
3. Click the Network tab. Then click the clear icon — a circle with a line through it — so you start from an empty log.
4. Now use the tool. Add the file, run it, download the result. Keep the Network tab visible while you do.
5. Read what appeared. Click any new row, then open the Payload tab (Chrome and Edge) or Request tab (Firefox). That shows you what was sent. You are looking for a POST or PUT whose body is roughly the size of your file.

The Chrome DevTools network documentation covers the panel in more depth if you want it, but for this check you need nothing beyond the five steps above.

The mistake almost everyone makes here

People expect the log to stay empty, see requests appear, and conclude the tool uploaded their file. That is usually wrong.

Every page makes network requests. Fonts, stylesheets, images, analytics, a menu that loads its links, a search box fetching an index. Most of those fire whether or not you touch the tool. An empty log is not the standard, and expecting one will make you distrust perfectly safe tools while missing the actual signal.

There is an easy way to tell the difference without reading a single line of code. Run the tool twice — once with a tiny file, once with a large one. Requests that are part of the page stay the same size both times. A request carrying your file grows with the file. If nothing in the log changes size when your file goes from 10 KB to 5 MB, your file is not in the log.

What a local tool looks like, and what an uploader looks like

A quick reference

What this test cannot tell you

Being straight about the limits is what separates a real check from a reassuring ritual.

It does not prove the tool is safe. A tool can process your file locally and still show you adverts, set tracking cookies, or record which pages you visited. Local processing solves one problem — file exposure — and only that one.

It is a snapshot, not a guarantee. You are checking what the site did in the moment you looked. Sites get updated, sold, and compromised. A result from six months ago tells you nothing about today.

It does not cover metadata. A tool could send the file’s name, size and type without sending the file. That is a much smaller exposure, but it is not zero, and a small request appearing at the moment you add a file is worth a look.

It cannot see server behaviour. If a tool does upload, the network log tells you the file was sent. It cannot tell you what happened next. That is the entire reason architecture matters more than policy: a file that is never sent needs no promises attached to it.

What came back when I ran this on our own tools

It would be weak to publish a verification method and not apply it here, so here is what I did and what it returned.

I took the image compressor and instrumented the page before touching it — I replaced the browser’s four outbound channels (fetch, XMLHttpRequest, sendBeacon and WebSocket) with versions that log every call and its payload size. That is a stricter version of reading the Network tab, because nothing can slip past it unnoticed.

Then I fed it a 1.21 MB PNG, 1400 × 1000 pixels, and asked for 100 KB.

I also read the page source for six tools — the image compressor, JPG to PDF, PDF to JPG, HEIC to JPG, Word Counter and Base64 Encoder. None of them contain a single XMLHttpRequest or sendBeacon call, and none load a third-party script. What they do contain is canvas.toBlob, drawImage, FileReader and createObjectURL — the browser’s own local file APIs.

And here is the detail that made me rewrite a section of this article. Loading the Word Counter page pulls in 76 separate resources — stylesheets, fonts, icons, images, the theme’s own scripts. Use the search box and it will fetch a list of page titles from this site’s own content endpoint as well. None of that carries anything you typed or dropped in, and none of it fires because you used the tool. But all of it lands in the Network tab.

If I had told you to expect an empty log, you would have run the test on this site, seen dozens of entries, and concluded we were lying. That is exactly why the rule is nothing carrying your data rather than nothing at all.

The full list of tools this applies to, and the ones we deliberately left off it, is on the no-upload tools page.

Red flags you can spot before opening developer tools

Most malicious converters give themselves away before any technical check.

You arrived from a sponsored search result. Fake converters buy ads and manipulate rankings — the security industry calls it SEO poisoning — precisely because the top of the results page is where people click without thinking. Being the first result is not a credential.

The domain is almost a name you know. One letter different, a hyphen inserted, or a .co where the real one is .com. Read the address bar properly rather than glancing at it.

The output has the wrong extension. You asked for a PDF and got .exe, .js, .msi or .scr. This is the attack itself. On Windows, turn on file extensions in File Explorer — on Windows 11 it is View → Show → File name extensions, on Windows 10 it is the File name extensions tick box on the View ribbon — because with them hidden a file named invoice.pdf.exe displays as invoice.pdf.

It wants a download, a sign-in, or an extension for a job that needs none. Converting an image does not require an account or a desktop installer.

It asks for an email to send you the file. That means a server did the work, kept the output, and now has your address attached to it.

How often should you check?

Once per tool is enough for ordinary use, and again if the site visibly changes. For anything genuinely sensitive — identity documents, financial records, medical files, unsigned contracts — the honest advice is not to run it through a web tool at all. Use software on your own machine. The best web tool in the world still asks you to trust a page you did not write.

That advice costs us traffic, and it is still the right advice.

Frequently asked questions