How to Check if an Online Tool Uploads Your Files
Many “free online” PDF and image tools upload your file to their servers to process it. Some don’t. You don’t have to take anyone’s word for it — including ours. Your browser can show you exactly what a page sends.
Why it matters
When a tool uploads a file, a copy exists on someone else’s computer for at least as long as the processing takes. Retention promises vary and are hard to verify. For contracts, ID scans, payslips, medical letters or tokens and API keys, the safest file is one that never leaves your device.
Test 1: watch the network (2 minutes)
- Open the tool page. Press F12 (Windows/Linux) or Cmd+Option+I (Mac) to open developer tools. In Safari, first enable “Show features for web developers” in Settings → Advanced.
- Go to the Network tab. Tick Preserve log so nothing disappears between steps.
- Click the clear button (🚫) so the list is empty.
- Now use the tool: add your file and run it.
- Look at the new rows. Sort by Method or Size. A POST or PUT request whose size is close to your file’s size means the file was sent somewhere. Click the row to see the destination under Headers.
Normal background requests (fonts, analytics pings, ads) are small. What you are looking for is a request roughly as big as your file, or one sent to a domain that processes files.
Test 2: go offline (1 minute)
Load the page, then disconnect: in developer tools set throttling to Offline (Network tab, “No throttling” menu), or switch on airplane mode. Use the tool again. If it still works and gives you a result, the processing happens in your browser. If it hangs or shows a network error, it needs a server.
What the results mean
| What you see | What it means |
|---|---|
| No large POST/PUT, works offline | Processed in your browser. The file did not leave your device. |
| Large POST/PUT to the site’s own domain | Uploaded to the site’s servers for processing. |
| Large request to another domain (storage or API) | Uploaded to a third party (cloud storage or a processing API). |
| Small requests only, but fails offline | Probably sends data in pieces or streams it. Treat it as an upload. |
How we test our own tools
Every Toolgix tool runs an automated browser test that fails if any non-GET request, or any request to another website, happens while the tool works. You can repeat the test above on any Toolgix tool page. The one optional exception is clearly labelled: the password strength checker can, if you tick the box, ask a breach database about the first 5 characters of the password’s SHA-1 hash (never the password itself).