The question underneath the question
“Is it safe” is really three questions, and separating them makes the answer much clearer.
- Does my file leave my machine?
- If it does, who can reach it, and for how long?
- How would I know?
Nearly all the risk lives in the first one. If the file never leaves, the other two do not arise.
What happens on an uploading converter
The ordinary, well-behaved case looks like this. Your file is transmitted over HTTPS to a server. It is written to disk or object storage. A worker process picks it up, converts it, and writes the result. You download the result. Some time later — usually stated as one to twenty-four hours — a cleanup job deletes both.
Nothing there is sinister. But note what has become true: a copy of your file exists on infrastructure you do not control, for a period you cannot verify, reachable by anyone who can reach that infrastructure.
The realistic risks are boring
The fear people have is theft. The things that actually happen are duller:
- A breach. Storage buckets are misconfigured with dull regularity. Files that were meant to be deleted in an hour turn out to have been retained for months.
- Terms of service. Some free tools grant themselves broad rights over uploaded content. Most people do not read them, and they are occasionally startling.
- Acquisition. The company that promised deletion is bought, and the new owner’s policy differs.
- Legal process. A subpoena reaches data that exists. It cannot reach data that does not.
- Logs and caches. The file itself may be deleted while its metadata, thumbnails or error-report copies persist elsewhere.
None of these require anyone to behave badly.
When it genuinely matters
For a photo of a cat, none of this is worth a moment’s thought.
The category worth caring about is narrow and predictable. It is what people most often convert:
- Identity documents — passports, driving licences, residence permits
- Financial records — bank statements, payslips, tax returns
- Medical documents — results, referrals, insurance claims
- Signed contracts — including the signature image itself
- Anything under NDA or professional confidentiality
Notice that these are exactly the documents people merge, extract pages from and photograph into PDFs. The most sensitive files are the ones most likely to need a converter.
How to check, in thirty seconds
You do not have to take anyone’s word for this, including ours.
- Open your browser’s developer tools (F12 on most, or ⌥⌘I on a Mac)
- Go to the Network tab
- Convert a file
- Look for a request whose size is roughly the size of your file
If your 4 MB photo is being uploaded, a 4 MB request appears. If nothing of that size leaves, the conversion is happening on your own machine.
This test works on any converter, and it is the only way to distinguish a privacy claim from a privacy fact.
How a browser-based converter avoids the problem
Modern browsers can run compiled code at close to native speed through WebAssembly. The same C and Rust libraries a server would use to decode a HEIC or assemble a PDF can run inside a web page.
When that happens, the shape of the operation changes completely. Your file is read from disk into your own device’s memory, transformed there, and handed back as a download. It never becomes the body of a network request. There is no server copy to retain, breach, subpoena or forget to delete — not because of a policy, but because it does not exist.
That is how every tool on this site works, and the Uploaded readout on each page is wired to the page’s own outbound network calls so you can watch it rather than believe it.
The honest summary
- Ordinary photos — uploading converters are fine. The risk is real but small, and so are the stakes.
- Anything with your identity, money, health or signature in it — use a converter that does not upload, or desktop software. The stakes are high and the alternative costs nothing.
- Either way — check the Network tab once. It takes half a minute and it replaces a guess with a fact.