PRACTICAL GUIDE
What Happens to the Files You Upload to Online Tools?
Where a file goes after you drop it on a converter, what retention policies really promise, and how to tell in under a minute whether anything was sent at all.
Last updated
The journey a file takes
On a conventional online converter, your file is transmitted to a server, written to disk or object storage, picked up by a worker process, converted, written back, and offered to you as a download link. That link is often a URL anyone could guess or share. Afterwards a cleanup job is supposed to delete both copies.
Along the way the file may pass through a content delivery network, a load balancer, and a logging system, and it may be replicated to a backup before the cleanup job ever runs. None of this is sinister. It is simply what handling a file on someone else's infrastructure involves.
What retention policies actually promise
A line saying files are deleted after one hour is a statement of intent about a process you cannot observe. It says nothing about backups, about logs that recorded the filename, about a support engineer who can list the bucket, or about what happens if the company is acquired or served with a legal request. Reputable services do their best to honour it. The point is that you are trusting rather than verifying.
The business model question
A tool with no advertising, no account and no paid tier is being funded somehow. Sometimes it is a side project, sometimes a lead magnet for a paid product, and sometimes the value is in the data — knowing which documents get converted, by whom, and from where. It is worth asking what the site gets out of being free, because the answer usually explains its architecture.
The alternative: nothing is sent
Browsers can now do most of this work themselves. Images can be decoded, resized and re-encoded through the canvas API. PDFs can be merged and split by a JavaScript library. Hashes come from the Web Crypto API built into the browser. None of it needs a server.
When a tool is built this way, the server's only job is to deliver the page. There is no upload endpoint, no storage bucket, no retention policy to trust — because there is nothing to retain.
How to check any tool in one minute
Open developer tools and switch to the Network tab. Clear it, then run the operation. An upload appears as a request with a payload roughly the size of your file, and it is unmistakable.
Then look at what else loads on the page. Scripts pulled from third-party CDNs and analytics domains are requests to other companies every time you open the tool — they do not carry your file, but they do reveal that you used it.
Finally, disconnect from the network and try again. A local tool works offline. An uploading one cannot.
How this site is built, and its limits
Every tool here processes your data in your browser. There is no upload endpoint anywhere in the application, and the libraries are bundled into the pages rather than fetched from a third-party CDN, so opening a tool does not announce anything to anyone else.
The honest caveat: the site loads Google Analytics, which is a third party, and it measures events such as opening or completing a tool. It never receives your files, filenames or content. If you would rather it did not run at all, a content blocker will stop it without affecting any of the tools, because none of them depend on it.
Frequently asked questions
Is a paid service safer than a free one?
It removes the incentive to monetise your data, which helps. It does not change the architecture: a paid service that processes files on its servers still holds your files. Paying buys you a contract and someone to hold accountable, not a technical guarantee.
What about tools that say they use end-to-end encryption?
Check what is being encrypted and where the key lives. Encrypting the file in your browser before uploading is meaningful if the service genuinely cannot decrypt it. If the server has to decrypt the file in order to convert it, the encryption protects the file in transit and nothing more.
Does using an incognito window help?
Not for this. Private browsing controls what your own device stores locally. It has no effect whatsoever on what a server receives or keeps once you upload something.
How can I be sure your tools do not upload anything?
Do not take our word for it — open the Network tab and watch. That verifiability is the reason the site avoids third-party CDNs: a claim you can check in thirty seconds is worth more than a paragraph in a privacy policy.