How to Check If a Website Is Uploading Your Files (a 10-Second Test)

By Chris · CYZOR Creations · September 2026

You drag a PDF into a “free online merge tool.” A progress bar fills. A few seconds later your merged file downloads. Simple.

But somewhere in those few seconds, a copy of your file left your computer. It went to a server you’ve never heard of, run by a company you didn’t check, possibly in a country you didn’t pick. Your contract, your bank statement, your kid’s medical form — uploaded, processed, and maybe deleted. The privacy policy says “files are deleted after an hour.” You have no way to verify that, and no recourse if it isn’t true.

Here’s the thing: you don’t have to trust the privacy policy. Your browser already ships with a tool that shows you, in real time, exactly what a website sends and where. It takes about ten seconds, needs no extensions, and works on any site. Once you’ve done it a few times, you’ll never look at a “free online converter” the same way.

The 10-second test

1. Open the tool’s page in Chrome, Edge, or Firefox.
2. Press F12 (or right-click anywhere → Inspect) to open Developer Tools.
3. Click the Network tab at the top of the panel.
4. Click the small Clear button to empty the list.
5. Now use the tool — upload your file, hit convert, whatever it does.
6. Watch the Network list.

That’s it. Every request the page makes shows up as a row: the URL, the size, the type. You’re looking for one thing.

What you’re looking for

Does your file go up? When a site uploads your document, you’ll see a request — usually a POST — with a size that matches your file. A 4 MB PDF produces a roughly 4 MB request going out. That row is your file leaving your device. If you see it, the tool is server-side: your data is now on someone else’s computer.

Does the list stay empty? If you process your file and nothing new appears — no upload, no POST carrying your data — then the work happened entirely in your browser. Your file never left. That’s what a genuinely private tool looks like, and it’s provable, not promised.

Two more things worth noticing while you’re in there:

• Third-party domains. Requests going to domains that aren’t the site you’re on — analytics, ad networks, “session recording” scripts — tell you who else is watching. A privacy-respecting tool has few or none.
• Loading vs. doing. A page always makes requests as it loads (scripts, fonts, images). That’s normal. The test is what happens when you do the actual task — which is why you clear the list first, so you’re only watching the part that matters.

Which tasks should never need a server

Not everything can run in your browser. If a tool has to email something, charge a card, or look up live data, it needs a server — and that’s fine. But a huge category of everyday tasks touches only your own data and doesn’t need to phone home at all:

• Merging, splitting, or rotating a PDF
• Converting an image to another format, or compressing it
• Formatting or validating JSON, or converting CSV to JSON
• Encoding or decoding Base64 and URL strings
• Recording your screen
• Resizing, cropping, or generating a favicon

Modern browsers can do all of these locally. The File API reads your file into memory, JavaScript libraries manipulate it, and the result downloads straight back to you — no round trip required. So when a tool for one of these jobs uploads your file anyway, it’s worth asking why. Usually the answer isn’t “it was technically necessary.” It’s “so we can show you ads, rate-limit you, and nudge you to upgrade.”

The habit worth building

You don’t need to run the test every time. But run it once on the tools you use for anything sensitive, and you’ll quickly sort them into two piles: the ones that quietly upload your files, and the ones that don’t. Keep the second pile.