Does this website upload your files?

Plenty of online converters promise to delete your files after an hour. Fewer can say they never receive them. With nothing but your browser, you can see which kind a site is.

try it anywhere

Two ways a file tool can work

Most online file tools upload your file to their server, process it there and send the result back. Your file sits on someone else's computer for a while, and you have to trust what they say about deleting it.

Some tools do the work inside your browser instead, with code the page downloads to your device. The file is read from your disk into memory and the result is saved straight back. Nothing goes over the network, so there is nothing to delete.

On screen the two look the same: a drop zone, a progress bar, a download button. The checks below show the difference.

Watch the Network panel

The Network panel in your browser's developer tools lists every request a page makes. If a site uploads your file, the upload has to show up there.

  1. Open the tool's page on a computer, then open the developer tools: F12, or Cmd+Option+I on a Mac.
  2. Select the Network tab. Tick Preserve log, so the list survives a page reload, and clear what's already there.
  3. Process a small test file, not one you care about.
  4. Look for requests sent with the POST or PUT method (right-click the column headers to show the Method column). Select one and read its request headers: a Content-Length close to your file's size, or a content type such as multipart/form-data, means your file went with it.
  5. Check where requests went, too. Uploads often go to a different address from the site itself, such as a cloud storage service.

Downloads are normal. The first time you use a tool, the page may fetch its code, WebAssembly modules or an AI model. Those come to you; what matters is what goes out.

Pull the plug

  1. Open the tool and process one test file, so everything it needs has loaded.
  2. Go offline: turn on airplane mode, or choose Offline in the Network panel's throttling menu.
  3. Process another file. If it works, the work happens on your device. If the tool stops with a network error, it needed a server.

One catch: a page could hold on to the file and send it once you're back online. Keep the Network panel open when you reconnect and watch what goes out.

Read the Content-Security-Policy

A site can send a Content-Security-Policy header: rules your browser enforces on the page, whatever the page's own scripts try to do. Its connect-src rule lists the servers that scripts on the page may send data to.

To see it, select the first request in the Network panel (the page itself) and find content-security-policy among the response headers. Or, from a terminal:

curl -sI https://example.com | grep -i content-security-policy

connect-src 'self' means scripts can only talk to the site's own address. A list of other addresses means they can send data to those too. No policy, or a * in connect-src, means the browser sets no limit.

A strict connect-src is a strong sign, not proof. 'self' still allows the site's own server, so pair it with the Network panel test. And connect-src covers the usual ways scripts send data (fetch, XHR, WebSockets, beacons), not every possible one: loading an image or submitting a form can carry data as well, which is why a careful site also restricts img-src and form-action.

What these checks can't tell you

  • What a server does with a file once it has one: how long it's kept, who can see it, what else it's used for. For that you only have the company's policy and your trust in it.
  • Whether the site changes tomorrow. A page can load different code on every visit, so a test covers the version you tested. Published source code and a strict policy make quiet changes harder.
  • What your browser extensions do. An extension allowed to read a page can see your files too, on any site.

The short version

Network panel
No POST or PUT request carrying your file.
Offline
The tool keeps working with the network off.
Policy
connect-src limited to the site itself.
Code
Published, so anyone can read what the page does.

Checking Eolietech

Eolietech's tools are built to pass every one of these checks. Its security page shows the exact policy the site sends and walks through the same tests on eolietech.com.