When you use a tool marked "stays on this device", your file or text is never sent to our servers. All the work happens inside your web browser, on your own computer or phone.
File transfer uses a separate connection service
Local File Transfer temporarily exchanges WebRTC connection information through a Cloudflare signaling room. Files, names and checksums travel directly over an encrypted DataChannel; they never pass through that room. There is no TURN relay or upload fallback. If the local connection cannot be established, transfer fails. These pages disable third-party scripts, and room/session data is not persisted.
What happens when you use a tool
- You choose a file or type some text. Your browser reads it into your device's memory.
- The tool's code, which your browser downloaded when the page opened, processes it right there.
- The result appears on screen, ready to copy or save to your device.
For tools marked “stays on this device”, there is no processing server in the middle. Close the tab and their input is forgotten.
How we make sure of it
- Browser-enforced rules. Pages for local tools tell your browser which websites they may talk to: our own website only. Your browser blocks everything else, even if something went wrong in our code.
- No upload servers. Our local-processing tool pages are static files. For these tools there is no server-side program that could receive a file.
- No tracking of what you enter. We don’t collect usage statistics. If we ever do, they will be limited to anonymous counts, never your files or text.
Check it yourself
Open a tool, then turn off your Wi-Fi or mobile data and use it. Tools that run on your device keep working. You can also open your browser's developer tools, choose the Network tab, and watch: no request contains your file.
Tools that need the internet
The HTTP Request Tester exists to send a request, so it sends requests by design. It is labelled "sent only where you point it": the request travels directly from your browser to the address you type, never through our servers, and nothing is kept. Only that page is allowed to connect to other sites; you can check in your browser's developer tools that every other page's Content Security Policy still saysconnect-src 'self'.
Local File Transfer additionally uses temporary signaling, as explained above; its files use a direct peer connection.