Local processing does not mean an offline website
A browser can download HTML, JavaScript, fonts, analytics scripts, and a machine-learning model from the web, then process your selected file in memory without uploading that file. The page used the network, but the file itself may still have remained on your device. The important question is not whether the page made any requests; it is whether your input or a recoverable copy was sent.
A practical five-minute check
- Use a disposable sample containing no private information.
- Open the browser's developer tools and select the Network panel.
- Clear the request list, choose the sample, and run the tool.
- Look for new POST or PUT requests, unusually large request bodies, or requests whose timing matches the conversion.
- Repeat once with the network disconnected. A truly local core operation often continues after its required scripts and models have already loaded.
This check is evidence for one browser session, not a permanent security audit. A later site update can change behavior.
What previews and downloads reveal
A preview URL beginning with blob: usually refers to browser memory. A data: URL embeds content directly in the page. Neither automatically proves privacy, but both are common in local workflows. A download that begins only after a server response is more likely to involve remote processing. The filename alone tells you nothing.
When not to use any public web tool
Do not test private client documents, identity records, unreleased source code, medical information, access tokens, or legally restricted files. Use an approved offline application or an organization-controlled environment when disclosure could create harm. Even a well-designed local tool still runs inside a browser with extensions, cached scripts, and device-level risks outside the publisher's control.
How WebFixKit labels tools
Our tool pages state when the core task is designed to run in the browser and identify important external libraries where relevant. That statement is intentionally narrower than “completely private” or “zero data collection,” because the host still processes ordinary delivery and security records. See the privacy policy and testing standards.
Bottom line
Use local processing as one privacy control, not as a substitute for judgment. Test with harmless data, inspect network behavior, keep originals, and choose an offline workflow for sensitive material.