How to verify that an online tool never uploads your files
“Your files never leave your device” is easy to write and hard to trust. Fortunately it is also easy to check. You do not need to be a developer, and the test takes about a minute.
What “processed in your browser” means
Most online file tools work in one of two ways:
- Server-side. Your file is uploaded to the company’s server, processed there, and the result is sent back. The company necessarily receives a copy.
- Client-side. The page downloads code (JavaScript, sometimes WebAssembly) and your browser does the work locally. The file is read from disk into memory and never needs to be sent anywhere.
YantraStack is built the second way, and the website itself is static: it serves pages and scripts, and has no endpoint that accepts uploads.
The Network tab test
- Open the tool you want to test in Chrome, Edge or Firefox.
- Press F12 (or Ctrl+Shift+I, Cmd+Option+I on a Mac) and open the Network tab.
- Click the clear button so the list is empty, and tick Preserve log.
- Add a file and run the tool.
- Look at the list of requests.
You should see no new requests while the file is being processed. Any requests you do see should be for the page’s own assets (scripts, fonts, WebAssembly) loaded the first time you use a tool.
What would be suspicious
- A
POSTorPUTrequest that appears when you add or process a file. - A request whose size roughly matches your file.
- Requests to a domain you do not recognise right after you pick a file.
Filter by Fetch/XHR to cut the noise, then sort by size. Uploads stand out.
The airplane-mode test
Even simpler: load the tool, then turn off your Wi-Fi (or tick Offline in the Network tab’s throttling menu) and use it again. A genuinely local tool keeps working. A server-side tool fails the moment it needs to talk to its server.
What this does and does not prove
Both tests show that your file is not sent over the network during that session. They do not prove anything about your computer itself: browser extensions can read pages, and malware can read files. If you work with highly sensitive material, use a clean browser profile with extensions disabled.
They also only apply to the tool you tested. Many websites mix approaches, so a site can have one local tool and several server-side ones. Test each tool you rely on.
Why local-first is a better default
- Less exposure. A file that is never copied cannot be breached, leaked, subpoenaed or retained.
- No limits designed around server cost. Server processing costs money, which is why many services cap free use or add watermarks. Local processing costs the provider almost nothing.
- Speed. There is no upload or download of large files, only the processing itself.
A note on passwords and secrets
The same reasoning applies to text you paste: JSON containing API keys, JWTs, passwords. Our JWT decoder and JSON formatter parse in your browser, and you can run the Network tab test on them exactly as above.