Search for almost any file conversion task and the results now all say some version of the same thing: 100% private, processed in your browser, files never leave your device. It has become the default marketing line in this category, which makes it useless for telling the tools apart. Some of those claims are accurate. Some are marketing copy over an ordinary upload.
The good news is that this is one of the few privacy claims you can verify yourself, in about two minutes, with no special software. Your browser already ships with the tool you need.
A file on your computer cannot reach a server by magic. It has to travel over the network, which means an HTTP request carrying those bytes. Your browser can show you every request a page makes. So if a tool genuinely processes your file locally, there will be no request containing it — and if it uploads, the upload is right there in the log.
Use a test file rather than the sensitive document you actually care about. A throwaway image or a PDF of something harmless tells you everything you need to know, and costs nothing if the answer turns out to be bad.
The column to look at is Size, and the thing to look for is a request roughly as large as your file.
If the tool processes locally, running the conversion adds almost nothing to the list. You may see small requests for fonts, icons, or analytics, but nothing on the order of megabytes, because your file never becomes a network request. On a site that also lazy-loads code, you might see one sizeable JavaScript file arrive the first time — that is the tool's own code coming to your machine, which is the opposite of your file leaving it.
If the tool uploads, you will see a request appear the moment conversion starts, typically a POST, with a size close to your file's size. Click it and check the request payload: your file is in there. The giveaway is the timing and the size together — a multi-megabyte POST that fires exactly when you hit Convert is your document going somewhere.
One more useful signal: try switching your network off after the page has fully loaded, then run a conversion. A genuinely local tool will often still work. An uploader cannot.
A completely empty Network tab is rare, and a few entries do not mean you have been misled:
The question to keep in mind is not "is there any network activity" but "is any of it carrying my file".
Worth being precise, because "runs in your browser" gets stretched to mean more than it does.
It does mean your file contents are not transmitted to the operator, so they cannot read, retain, index, or leak them, and there is no copy sitting in a storage bucket waiting for a future breach.
It does not mean the page is offline or self-contained. The site still has to load, so the operator still sees that you visited. It does not mean there is no analytics. It does not mean the code could not change tomorrow — you are verifying the tool as it is today, not signing a contract. And it says nothing about the rest of the site's security posture.
For most people this is still a large improvement, because the file contents are the sensitive part. Just do not read it as a guarantee of anonymity.
Because “trust us, nothing is uploaded” is exactly what a tool that uploads would also say, and I have no way to prove the claim through assertion. What I can do is point you at the check.
So please run it here. Open the Network tab, use the Merge PDF tool or any image converter, and watch. No request will carry your file. Then use the same test on the next tool you are considering. A claim you can verify in two minutes is worth more than one you have to take on faith.
