About Filestay

Why this exists

There is a moment familiar to anyone who has applied for a visa. You have photographed your passport, the portal wants a JPG under 200 KB, and your phone produced a 4 MB HEIC. So you search for a converter, find one that looks reasonable, and upload a photograph of your passport to a server owned by someone you have never heard of, in a country you did not choose, with a privacy policy you did not read.

Most of those services are probably fine. The problem is that "probably fine" is the strongest statement anyone can make, and you are the one carrying the risk.

The odd thing is that the upload was never necessary. Browsers have been able to decode and encode images and PDFs locally for years — WebAssembly made it fast, and the codecs are open source. The uploading is a habit left over from when it was the only option, and it persists because it is a convenient place to attach a business model.

The constraint

Every tool here runs inside your browser. Not "mostly". Not "for small files". There is no upload endpoint anywhere in the product, and the code that touches files makes no network calls at all — a lint rule forbids it and the content security policy would block it.

The counter in the header is not decoration. It wraps every network API the page can use —fetch, XMLHttpRequest, sendBeacon — and counts any binary payload the page tries to send. It reads 0 B. If a change ever broke that, the counter would say so on every page, and anyone could see it.

That constraint produces the rest of the product almost automatically. No uploads means no bandwidth bill, which means no reason to cap file sizes or count daily conversions. No server means no queue, so results appear immediately. And because everything needed is already on your device, it all works offline.

How it makes money

Advertising, and nothing else. There is no paid tier, no data sale, and nothing to sell even if we wanted to — we do not have your files, and the analytics deliberately cannot record anything derived from them.

Ads sit in the margins and after the article content. They are labelled, kept a hard distance from any download button, and reserve their space in the layout so nothing jumps as the page loads. If an ad ever looks like part of a tool, that is a bug — tell us and it will be fixed.

What it is built from

The site is Astro, which ships static HTML with no JavaScript on content pages, and hydrates each tool as an isolated island only where one is actually used. Tools are Preact components talking to Web Workers, which talk to WebAssembly codecs.

The codecs are not ours. MozJPEG, libwebp, libavif, OxiPNG, libheif, pdf-lib and pdf.js do the real work, and the whole project is standing on decades of other people's effort. They are all listed with their licences on the licences page.

What it deliberately does not do

• PDF to Word. Client-side conversion produces mangled tables and reordered text. Doing it badly would undermine trust in everything else.
• Accounts. There is nothing to store, so there is nothing to log in to.
• Email capture. No newsletter popup, no "enter your email to download".
• Guarantees about passport photo acceptance. We match the published technical specification exactly and cite the source. Whether an official accepts your photograph is not something software can promise.

Getting in touch

hello@filestay.app reaches a person. Bug reports with the browser name and what you were doing are especially welcome; so are corrections to any passport requirement that has changed.