toolkit Nothing is uploaded — here is how to check
Every file converter has a privacy claim on it somewhere. Almost none of them give you a way to test it. This page does: the checks below take about thirty seconds each, need nothing but the browser you are already using, and would catch us immediately if we were lying.
What the claim actually is
When you convert a file here, the bytes of that file are never transmitted anywhere. The decoders and encoders are WebAssembly modules your browser downloads once and then runs locally, on your own processor. There is no upload endpoint in this site's code for file contents to reach, because none was ever written.
That is a narrow claim, and it is narrow on purpose. It is about your files. It is not a claim that the page makes no network requests at all — the section below on what the site does send lists those, because a page that hid them would not be worth trusting on the first claim either.
Check it yourself: the network tab
Open any tool on this site. Before converting anything, press F12 (or Cmd+Option+I on a Mac) to open developer tools, and select the Network tab. Tick 'Preserve log' if it is offered.
Now drop a file in and convert it. Watch the list. You will see the WebAssembly module for that format download the first time — a file such as heic_bg.wasm, coming from this domain — and you will see nothing carrying your file the other way. Sort by size, or filter the list to Fetch/XHR: an upload would have to appear as a request with your file's worth of bytes in its payload, and there is no way to hide one from this panel.
The absence is the whole point. A converter that uploads cannot conceal it here, because the browser reports every request a page makes, including the ones a page would rather you did not see.
The stronger check: turn off your network
The network tab shows what the page did. This shows what it is capable of. Load any tool page, then disconnect from Wi-Fi or switch on airplane mode, and convert a file. It still works.
One caveat, and it is an honest one: the first conversion of a given format needs to fetch that format's WebAssembly module, so run one conversion while connected before going offline, or the module will not be in the cache yet. After that the machine is entirely local, and staying offline demonstrates it in a way no promise can.
The check you do not have to perform yourself
Every page here is served with a Content Security Policy header: a list — enforced by your browser, not by us — of the only places this page is permitted to send anything at all. You can read ours in the response headers for any page, in that same Network tab.
This matters because it is not a promise, it is a constraint. If this site's JavaScript tried to send your photo to a server not named in that policy, your browser would refuse the request and record a violation. The policy is what makes 'nothing is uploaded' checkable by machine rather than believable by reputation.
What the site does send
Being straight about this is the point of the page. On the live site, privatetoolkit.org loads Google Analytics, which reports that a page was viewed and roughly where in the world from. It is configured with Google Signals and ad personalisation both switched off. It knows a page had a visitor; it is not given, and could not be given, anything about your files, because the conversion code and the analytics code never touch.
The site also has an ad slot, which is switched off entirely as this is written — no ad script is loaded at all. If it is switched back on it will be a single banner from one network, and it will be labelled as an advertisement.
That is the complete list. No account system, no cookies from us beyond what analytics sets, no file storage — and nothing to store, because your files never arrive.
What this design costs you
It would be dishonest to sell 'runs on your device' as free. Your processor does the work, so a long video takes real time and a very large file needs enough memory to hold it; a server farm would be faster. Some conversions a server could do are not possible in a browser at all.
And a container conversion changes the container, not the codec. An HEVC video from an iPhone becomes an MP4 that still will not play on a machine with no HEVC decoder. We say so when it happens, instead of reporting a success you would discover was useless later.
Frequently asked questions
Can I really check this myself, without being a developer?
Yes. The network tab check is opening a panel and looking at a list — you are checking whether something is there, not reading code. The offline check needs even less than that: turn off Wi-Fi and see whether the tool still works.
Do my files get deleted after conversion?
There is nothing to delete. The files never reach a server, so no copy exists anywhere for us to keep or remove. Most converters answer this question with a retention period; here the honest answer is that the question does not arise.
Is there a file size limit?
None that we impose. The practical limit is your own device's memory, since the file is held there while it converts. Nothing is capped for billing reasons, because a conversion costs us nothing to run.
Does this work offline?
Yes, once the WebAssembly module for the format you want has been fetched. Convert one file of that type while online, and after that the tool keeps working with the network off.
How do I know the WebAssembly module itself is not sending my file somewhere?
The same Content Security Policy covers it — it runs inside the page and is bound by the same enforced list of permitted destinations. Anything it tried to send elsewhere would be blocked by your browser and recorded as a violation.