What happens on a typical online converter
Your file travels from your browser to the service's servers, where a worker process converts it, stores the result, and hands you a download link. Every stage involves copies: in transit, at rest in storage or object storage, in logs, and often in a temporary bucket 'for performance'. Reputable services delete uploads on a schedule — minutes, hours or days. The trust you are extending covers their deletion promises, their security posture and their staff.
The realistic risks
- Retention: files kept longer than the privacy policy says, or policies that quietly change
- Breach history: converter sites are small targets with modest security budgets
- Third-party processing: CDN logs, analytics and ad networks may see URLs of your files
- Sensitive content: personal photos, IDs, medical or client material should never leave your device
- No recourse: if something leaks, you often will not know it happened
How no-upload (browser-local) conversion works
Modern browsers can decode and re-encode images on your device: WebP and JPG natively through the canvas, HEIC through WebAssembly ports of libheif. A local converter ships that code to your browser and runs it there — your file is read from disk, converted in memory, and written back to disk. Watch the network tab on this site while converting: zero uploads. You can even disconnect from the internet after the page loads.
When is uploading actually fine?
For images with no personal, client or sensitive content, and where convenience beats caution, established converters are fine — their businesses depend on not mishandling files. The red lines are different: identity documents, medical images, unpublished client work, anything under NDA, and children's photos deserve local processing. The rule of thumb: if you would not email it to a stranger, do not upload it to one.
How to verify a tool is really local
Three checks: open your browser's developer tools, watch the Network tab during conversion (zero requests carrying your file means it is local); turn off your Wi-Fi after the page loads and see if conversion still works; and check the privacy policy for the phrase 'files are processed in your browser' rather than 'we delete uploads after N hours'. The second phrasing means they had your files first.