How to verify a website does not upload your files

"Your files never leave your device" is an easy sentence to write and a hard one to prove from the outside. Fortunately, you don't need to trust anyone. Your browser sees every request a page makes, and it will show you.

The five-step check (Chrome, Edge, Brave)

1. Open the tool page, then open developer tools: F12 or Ctrl+Shift+I (⌥⌘I on Mac).
2. Click the Network tab.
3. Tick Preserve log and press the clear button to empty the list.
4. Add your file and run the tool.
5. Read the list. A tool that uploads your file will show a request, usually POST or PUT, with a size close to your file's. A truly local tool shows nothing new, apart from blob: or data: entries, which are the browser handing data to itself.

Firefox and Safari

Firefox: F12 → Network → the trash can icon to clear. Safari: enable the Develop menu in Settings → Advanced, then Develop → Show Web Inspector → Network.

The offline test

This is the most convincing check. Load the page, then turn off your network. You can do this using the throttling drop-down in the Network tab ("Offline"), or by switching on airplane mode. Use the tool again. If it still works, it cannot be uploading: there is no connection to upload through.

What to look for beyond the obvious

• Other domains. Sort by Domain. Requests to analytics, ad or tag-manager servers are not file uploads but they are still tracking. A privacy tool should have none.
• Service workers and WebSockets. Filter by WS and look in Application → Service Workers. Uploads can hide there.
• The Payload tab. If you do see a request, click it and open Payload to see what was sent.
• CDNs. Libraries loaded from a CDN make requests when the page loads. They are not uploads, but they tell the CDN that you visited. Bundling libraries into the site removes this. QuokkaTools serves everything from its own domain.

A stronger guarantee: the Content-Security-Policy

A site can instruct the browser to forbid connections to other servers using a Content-Security-Policy (delivered as a response header or as a <meta http-equiv="Content-Security-Policy"> tag in the page source). View the page source and look for it. For a local-only tool, you should see connect-src 'self' (or stricter) and no external hosts in script-src. Then even a bug cannot send data elsewhere.

What this does not prove

The Network tab shows what the page does right now. A site could change tomorrow. If you handle highly sensitive files, run the check each time, or save the page for offline use. And of course, if you do not trust the browser or the device, no website can help you.

Try it on our Metadata Remover: drop in a photo and watch the Network tab stay quiet.