The file has nowhere to go.
“Processed locally” is easy to print on a page. This is the mechanism behind it, the checks you can run, and the exact boundary of the claim.
A live PerformanceObserver updates this number if the page loads a resource from another origin.
connect-src 'none'
This directive is in the HTTP Content-Security-Policy header on every page. It tells the browser to refuse fetch, XHR, WebSocket and beacon connections from the tool.
What happens when you choose a file
- The browser gives this tab a temporary reference to the file you selected. Choosing it does not upload it.
- Image pixels are decoded with browser APIs. PDF objects are read by a library served from this same domain.
- The result is built in memory and exposed through a local
blob:URL. That URL exists only in this browser session. - Download writes the new bytes back to your device. Reloading the page discards the working memory.
Three ways to verify it yourself
| Check | What to do | What you should see |
|---|---|---|
| Network panel | Open browser developer tools, choose Network, then process a file. | No request carrying the file, filename or output. |
| Offline test | Open a tool once, disconnect from the internet, then use it. | The visited tool still runs from its service-worker cache. |
| Security header | Inspect the document response in browser developer tools. | connect-src 'none', blocking fetch, XHR, WebSocket and beacon connections. |
The boundary, stated precisely
The site itself still has to reach your browser, so Cloudflare serves the HTML, scripts, styles and fonts and may keep ordinary security logs such as an IP address and timestamp. Your selected file, its name, its pixels and the result are not sent with those requests.
No advertising network is active on this deployment. Nothing on a tool page contacts another company automatically.
Third-party code, served locally
The PDF engine uses pdf-lib. The HEIC converter uses the LGPL-3.0-licensed heic-to decoder, whose LGPL-3.0 licence is published with the site. These scripts are copied into the build and served from NoUpload; opening a tool never asks a package CDN or its author for code.