What actually happens when you upload a file to an online converter

Let us be precise rather than alarming. Most online file converters are run by ordinary people trying to make a living, and most of them delete your files roughly when they say they do. The argument here is not that they are malicious. It is that the whole arrangement is unnecessary, and that “unnecessary risk” is still risk.

The chain of custody

When you upload a file to a converter, here is what your file passes through.

Your browser to their server. Over HTTPS, so an eavesdropper on the network sees encrypted traffic. Fine.

Their TLS terminator. Almost always a CDN or load balancer — Cloudflare, Fastly, an AWS load balancer. At this point the encryption is stripped and your file exists as plaintext in a third party’s memory. This is normal architecture, not a flaw. It is also a company you never chose and whose name you may not know.

Their application server. Your file is written to disk, usually to a temporary directory. It is now at rest, unencrypted, on a machine you know nothing about.

Their processing worker. Often a separate machine, so the file is copied again, sometimes through a queue like Redis or S3, where it may persist longer than the file itself.

Their storage for the result. The converted file needs to live somewhere long enough for you to download it. Typically an object store with a URL.

Their backups. This is the step nobody thinks about. If the temporary directory or object store is included in a nightly backup — and it usually is, because excluding directories from backups is a deliberate act that someone has to remember — your file survives in that backup for the backup retention period. A “deleted after one hour” policy and a 30-day backup rotation are not contradictory statements; they are just talking about different copies.

Their logs. File names appear in access logs. passport_scan_final.pdf in a log line is metadata about you, and logs are retained far longer than files.

The download URL problem

A specific and common failure: the result of your conversion is served from a URL like https://example.com/downloads/a8f3c2/converted.jpg.

That URL is often unguessable but rarely authenticated. Anyone who obtains it — through a browser extension you installed, a corporate proxy, a referrer header, a shared screenshot, or the browser history on a shared computer — can fetch the file. Several converters have historically made these URLs sequential or predictable, which turns “unguessable” into “enumerable”.

What people actually convert

This is the part that makes it matter. Look at what the highest-volume conversions are:

• HEIC to JPG, because someone photographed a document with an iPhone.
• Merge PDF, because someone is assembling an application pack — bank statements, payslips, a passport scan.
• Compress to 50 KB, because a visa portal has a limit.
• Image to PDF, because a form wants a PDF and the user has a photograph of a certificate.

The traffic is not holiday snaps. It is identity documents, financial records and medical files, because those are the things people are asked to submit through systems with format requirements.

The terms you agreed to

Read a few converter terms of service and a pattern appears. Many contain a licence grant along the lines of: “You grant us a worldwide, non-exclusive, royalty-free licence to use, reproduce and process the content you upload for the purpose of providing the service.”

That clause is legally necessary — they do need permission to make a copy in order to convert it. But the scope is often broader than the purpose requires, and “for the purpose of providing and improving the service” quietly includes training data.

What changed

The upload was necessary once. Browsers could not decode a HEIC file, could not run a JPEG encoder at reasonable speed, and could not parse a PDF. Server-side was the only option.

Three things changed that.

WebAssembly shipped in all major browsers in 2017. It runs compiled C and Rust at close to native speed, which means the actual codecs — libjpeg, libwebp, libheif, libavif — can be compiled and run in a browser tab.

Web Workers let that run on a background thread, so a heavy encode does not freeze the page.

The File System Access API and modern File APIs let a page read a file the user selects, and write a result back, without either passing through a server.

Together these mean that everything a conversion service does on its servers can be done in the tab. Not “for small files” — for all of them. The only thing a server can offer is more compute than your device has, which matters for video and rarely for anything else.

How to tell which kind you are using

Two checks take ten seconds.

The Network tab. Open developer tools (F12), go to Network, and run the conversion. If you see a POST request with your file in the payload, it was uploaded. If you see nothing, it was not.

Turn off your Wi-Fi. Load the page first, then disconnect, then convert. A local tool keeps working. A server-based one fails immediately. This is the more convincing test, because it cannot be faked.

What local processing does not fix

Being honest about the limits:

• The page itself is still loaded over the network. A compromised or malicious page could exfiltrate a file. The defence is the same as any web security: a Content Security Policy that restricts where the page may connect, plus the ability for anyone to inspect what it does.
• Your device could be compromised. No web page can help with that.
• Metadata still travels with the file after you are done with it. Converting removes EXIF as a side effect of re-encoding, but if you send the original somewhere else, it goes too. Our EXIF viewer shows you what is in there.

The practical position

For a holiday photo, none of this matters much. For a photograph of your passport, a bank statement, a medical record or a signed contract, the calculation is different — and the alternative now exists.

Every tool on this site runs in your browser. You can verify it with the Network tab, and you can verify it harder by turning off your connection and watching everything keep working.