How online tools work without uploading anything
Published: · Last updated:
Plenty of online tools say “nothing is sent to a server”, but the sentence alone doesn’t tell you whether it’s true. This guide explains what the claim means technically and gives you two checks that take 2–3 minutes. They work on this site and on any other site’s tools.
Where your input goes
An online tool can handle your input in one of two ways.
| Server-side | In the browser | |
|---|---|---|
| Where the work happens | On the operator’s server | In the browser on your device |
| Where your input goes | Across the internet to the server | It doesn’t leave your device |
| When you see the result | After the server responds | As soon as you type |
| If the connection drops | It stops working | A page that’s already open keeps working |
With a server-side tool, pressing the button makes the page package your input into a request and send it to the server. Code in a page talks to a server with features such as fetch, and the browser records every request sent this way. Whether the server stores your input, and for how long, is something you can’t check from the outside.
With an in-browser tool, the page downloads the program it needs (JavaScript, WebAssembly) when it loads, and that program runs on your device. For example, the random values behind a generated password come from crypto.getRandomValues(), which is built into the browser, and a hash is calculated on your device by WebAssembly code the page downloaded. The server’s only job is to hand over the program.
How this site is built
This site is a static site: it only serves files that were built in advance. There is no server program that receives tool input, so there is nowhere to send it. Some tools download extra code the first time you run them. Those requests fetch a file, and your input isn’t part of them.
That doesn’t mean the page makes no requests at all. The hosting service that delivers the page processes your IP address and browser details, and the analytics script and the ad scripts talk to their own servers. These requests happen regardless of what you type into a tool. The privacy policy lists what is processed.
Check 1: watch the requests in the Network tab
Your browser’s developer tools include a Network tab that shows every request the page sends and receives. The steps are the same in Chrome, Edge and Firefox.
- Open the tool page, press
F12(Cmd + Option + Ion a Mac) to open the developer tools, and select the Network tab. - Use the clear button to empty the log.
- Type something easy to spot, such as
zebra-4821, into the tool’s input box, and press the tool’s button if it has one. - See whether a new row appears. If none does, the page sent no request anywhere while you typed.
- If a row did appear, click it and look for your string in the request address (Headers) and in what was sent (Payload).
A new row doesn’t by itself mean your input was sent. Ad scripts can make requests no matter what you type, and a tool that loads extra code on first use creates a request for a .js or .wasm file. What matters is whether the request’s address or payload contains what you typed.
Check 2: go offline
With the Network tab alone, it’s hard to rule out input that is altered beyond recognition before it’s sent, or collected and sent later. Cutting the connection is a firmer test.
- Open the tool page and run the tool once, so that a tool needing extra code has already fetched it.
- Disconnect. In Chrome and Edge, choose Offline in the Network tab’s throttling menu. In other browsers, turn off Wi-Fi or mobile data on your device.
- Without reloading the page, change the input. If the result keeps updating, the work is happening on your device.
- Reconnect when you’re done.
A server-side tool shows an error or no result in this state. This site doesn’t store its pages on your device, so reloading while offline fails to load the page at all.
What in-browser processing doesn’t solve
Running in the browser doesn’t remove every concern.
- Device speed and memory: your device does the work, so a large file or a long text can be slow or freeze the tab. Sometimes a server-side tool can handle sizes that an in-browser tool can’t.
- Browser extensions: an extension can read the content of pages it has permission for. Even if the tool sends nothing, an extension can still see what’s in the input box. For sensitive content, use a window with extensions turned off.
- Your screen and device: what you type is visible on screen, and anything you copy stays on the clipboard. On a shared device, close the tab when you’re finished.
- Code can change: a page is downloaded again each time you open it, so what you verified today doesn’t guarantee how it behaves on your next visit.
What “no upload” covers
“No upload” describes how the input you give a tool is handled. It doesn’t mean the site as a whole handles no information, and a site could use the same wording while sending your input anyway. That’s why the checks matter more than the wording. Before you paste a value that would hurt to leak, such as a secret key for a live service or a password you actually use, run the two checks above first. You can try them right away on the related tools below.