The privacy case for browser-only tools
If a file never leaves your device, it cannot be leaked by a server. That single property changes how you should evaluate an online tool.
The hidden cost of convenience
Most "free online converters" work by uploading your file. The service needs storage, a queue and a cleanup job — all of which cost money and create copies. Retention policies are usually honest, but they are still policies, not physics.
A browser-only tool has a different failure mode: the file stays in memory. Close the tab and it is gone. There is nothing to retain, breach or subpoena.
What "runs locally" should mean
The phrase is overused. A useful test:
- Open the tool, then switch off your network connection.
- Try the core action.
- If it still works, the processing is local.
Tools that call an AI model or look up live data cannot pass this test, and they should say so plainly. Mixed models are fine as long as the boundary is visible.
What still leaves your device
Even a local tool can phone home. Check for:
- Analytics events that include file names or contents (they should not)
- Third-party scripts loaded from CDNs
- Error reporting that captures input
- Ads whose pixels track behaviour across pages
A privacy-first site should keep the default build free of trackers, and load anything optional only after consent.
Practical habits
- Prefer tools that describe their architecture in one sentence.
- Strip metadata before publishing photos.
- Never paste production secrets into any web page, local or not.
- Keep a copy of originals until the output is verified.
The trade-off, stated honestly
Local processing has limits: no giant batches, no server-grade CPUs, and features that need a model must call out. In exchange you get speed without a queue and documents that never become someone else's data.
For one-off jobs — a merged PDF, a resized photo, a formatted payload — that trade is usually the right one.