Open audit · reviewed 30 July 2026
Browser-side file privacy audit
“No upload” should be testable. This audit documents where five priority tools process a selected file, what network traffic is expected, how the result is delivered, and which automated checks guard the claim. Download the audit dataset as CSV.
Audited tool matrix
| Tool | Local engine | What happens locally | Limit | Automated evidence |
|---|---|---|---|---|
| Add Page Numbers to PDF | pdf-lib | Reads, edits, and saves the PDF in the tab | 200 pages | No selected-file request; valid PDF and page count |
| Reverse GIF | ffmpeg.wasm | Buffers and reverses the animation in browser memory | 512 MB input | No selected-file request; GIF dimensions and duration |
| Change GIF Speed | ffmpeg.wasm | Changes frame timestamps in browser memory | 512 MB input | No selected-file request; shorter 2× output duration |
| Resize GIF | ffmpeg.wasm | Scales frames and rebuilds the palette in browser memory | 512 MB input | No selected-file request; exact 480 px output width |
| Remove Image Metadata | Byte-level JavaScript | Copies image data while removing metadata records | Browser memory | No selected-file request; valid cleaned output |
Run a local-read network check
Choose any file below. This audit widget clears the Resource Timing list, reads the file with the browser File API, calculates SHA-256 locally, and reports any network resources initiated during that operation. It does not run a conversion and does not retain the file or hash.
Scope: this interactive check proves the audit widget’s read-and-hash path. The tool claims are separately covered by browser tests that inspect requests and validate real output files.
Expected network boundary
- Expected: HTML, JavaScript, fonts, images, workers, and required WebAssembly engines.
- Expected:
POST /api/eventwith only the current path and event type. - Not expected: a request containing a selected filename, file bytes, generated output, account ID, or fingerprint.
- Downloads use a local
blob:URL created by the browser.
Reproduce the full check
- Open a tool, load any required engine once, and clear the Network panel.
- Select a uniquely named test file, run the tool, and download the result.
- Search request URLs and payloads for the filename or a unique marker embedded in the file.
- Repeat after taking the browser offline. Engine-backed tools work offline after their engine has loaded.
- Validate the downloaded file independently; a missing upload is not proof of a correct output.
Limits of this audit
This is a product audit, not a third-party security certification. It covers the published browser code and representative fixtures on the review date. Browser extensions, modified site code, compromised devices, and unsupported or malformed files are outside its scope. The testing methodology, privacy policy, and browser limits provide additional context.