How to check that a website does not upload your files

“Your files never leave your device” is easy to write on a web page. Here is how to find out whether it is true, for this site or any other.

Test 1: airplane mode

This needs no tools and works on a phone.

1. Open the tool’s page and wait until it has finished loading.
2. Turn on airplane mode, or switch off Wi-Fi and mobile data. On a computer, pull out the network cable or turn Wi-Fi off.
3. Add a file and run the tool.
4. Save the result.

If the tool finishes and gives you a file, the work was done on your device, because there was nothing else it could reach. If it spins, fails or says it is “uploading”, it needs a server.

One caution: a site could do the work locally and still send a copy of your file later, when you reconnect. So keep going.

Test 2: watch the network

Every desktop browser can show what a page sends.

1. Open the page, then open the developer tools (F12, or right-click and choose Inspect) and pick the Network tab.
2. Clear the list, then add your file and run the tool.
3. Look at what appears. Pay attention to the size of each request: an upload of a 5 MB photo is a request of about 5 MB.

On a tool that works locally you will see nothing, or small requests for the tool’s own code. You will not see anything the size of your file going out.

Test 3: read the rules the browser enforces

A site can ask the browser to forbid the page from contacting other servers. This is called a Content Security Policy, and once set, the browser enforces it even against the site’s own code.

In the Network tab, click the page’s first request and look for the Content-Security-Policy header. The line that matters is connect-src. If it lists only the site itself, the page cannot send data to anyone else.

On this site the tools run in a sealed frame on its own domain with exactly that kind of policy. The check page prints it in full.

What these tests cannot show

• Other sites’ scripts. Adverts and analytics on a page can see what that page can see. That is why the tools here are in a separate frame that adverts cannot look into.
• Your own device. Malware or a browser extension with permission to read every page can see your files regardless of what a website does.
• Tomorrow’s version. A site can change. A published security policy and build fingerprints let others notice if it does.

A habit that takes ten seconds

Before giving a sensitive file to any web tool, turn on airplane mode after the page loads. If it still works, carry on. If it does not, you have learned where your file was about to go.