How to Tell If a Converter Uploads Your Files

Why the question is worth asking

Converting a file is a small, boring task, and most people hand it to whatever site is at the top of the results without a second thought. That is usually harmless. It stops being harmless when the file is a passport scan, a medical result, a signed contract, or an ID for a rental application — anything you would not email to a stranger, because if the conversion runs on a server, emailing it to a stranger is functionally what you did.

Server-side conversion is not sinister in itself. It is a legitimate architecture: some formats genuinely need software too large to run in a browser, and plenty of operators handle uploaded files responsibly. The problem is that from the outside the two are identical — same drop zone, same spinner, same download link — and the marketing copy is often word-for-word the same too.

So stop reading the copy and check the behavior.

Test one: watch the Network tab

Open the converter page, then open your browser's developer tools — F12 on Windows and Linux, or Command-Option-I on a Mac — and switch to the Network tab. Reload the page once with the panel open so it records everything, then clear the list using the circle-with-a-slash button. Now pick your file and convert it, and watch what appears.

If the work is happening on your device, the list stays essentially empty from the moment the file picker closes. You may see a script or a WebAssembly module download before the conversion starts — that is code arriving on your machine, which is the opposite of your file leaving it. The tell for a genuine upload is a request whose method is POST or PUT, whose size roughly matches your file, and whose destination is a server domain. Click it and open the Payload or Request tab; you will see your file's bytes, or a form field containing them.

Two refinements make the test harder to fool. Set the filter to All so nothing is hidden — websocket connections sit under a separate WS filter and can carry file data just as well as an ordinary request. And read the size column, not just the count: a few hundred bytes of analytics is a different thing from four megabytes leaving your machine.

One more signal needs no devtools at all. A conversion running on your device is limited by your processor, so it takes about the same time on hotel wifi as on fiber. A conversion running on a server is limited by your upload speed, usually the slowest link you own. If the same file converts in two seconds at the office and forty at a cafe, the file is going somewhere.

Test two: turn the network off

This is the decisive one, because there is no way to fake it. Load the converter page normally, with a connection, and give it a moment to finish loading anything it needs. Then switch on airplane mode or turn off wifi entirely — and, without reloading the page, convert a file.

If the conversion completes, the work happened on your device. There is no interpretation required and no trust involved: with no network there is no server, so whatever produced that output was running in your browser. If instead it hangs, errors, or spins forever, the work was being done somewhere else.

Two caveats keep the test fair. Do not reload the page while offline — an ordinary site cannot load without a connection, and that failure says nothing about where conversion happens. And a site that needs a one-time component download, such as a decoder for a format your browser cannot read natively, will fail the first time you try it offline and work on every attempt after. Give it one online visit before you judge it.

A site that keeps working with the network switched off is making a structural promise rather than a verbal one. It is not that the operator has decided not to upload your files; it is that there is nothing to upload them to and no connection to do it over. That is the difference between a policy and a property, and it is the entire reason this site is built the way it is — you can run this test on any converter here right now.

Read the privacy policy for what it admits

Policies are written to reassure, but they are also written by lawyers who cannot describe something that does not happen. That makes the reassuring sentences unusually informative if you read them literally.

"Files are automatically deleted after 24 hours." This is the most common line on converter sites and it is presented as a privacy feature. Read it again: deletion presupposes storage, and storage presupposes receipt. The sentence is a plain statement that your file was uploaded to a server, written to disk, and kept there for a day. It may well be deleted exactly as promised — but the promise is about what happens after the upload, not whether one occurred.

"Encrypted in transit" or "secure connection." True of essentially every website, and it describes only the journey. TLS protects your file from being read on the way to the destination; it says nothing whatsoever about what the destination does with it once decrypted.

"We do not look at your files." A statement about intent, which is exactly the kind of claim you cannot verify. It also concedes the important fact: to not look at your files, they must have your files.

"Processed on our secure servers." Direct and honest. Take it at face value and decide accordingly.

Language that points the other way includes "in your browser", "client-side", "on your device", "no server", or a specific technical account of the pipeline. That is a better sign — but it is still a claim, and the whole point of this guide is that claims are testable. Run the offline check anyway. Any site that means it will pass.

What these tests do and do not prove

They prove what happened during your test. That is a strong result — far stronger than any assurance in a footer — but it is bounded. A site could behave differently for a file type you did not try, or after its next deployment. If a converter is part of your routine for sensitive material, repeat the offline check occasionally rather than treating one pass as permanent.

They also do not speak to anything besides file handling. A site that converts entirely on your device can still load third-party analytics or advertising that knows you visited. That is worth knowing separately, and it is visible in the same Network tab — it just is not the same question as whether your document left your machine.

What you gain is the ability to stop guessing. Two minutes with the Network tab and one conversion with the wifi off tell you more than an hour of reading marketing copy, and the skill transfers to every other tool you hand a file to.