<\/p>\n
<\/p>\n
Before you upload a file to an online tool, you should be able to answer seven questions about what happens next. Most people skip this step \u2014 and most tools are counting on that. This checklist takes under two minutes and tells you whether your file is genuinely safe to hand over.<\/p>\n
Many tools that look<\/em> like upload tools are actually running in your browser. A browser-based tool reads your file locally \u2014 it never leaves your device \u2014 while a server-side tool uploads the file to the company’s infrastructure before processing it.<\/p>\n How to tell: open your browser’s network tab (F12 \u2192 Network) before you drop the file in. If you see a POST or PUT request go out when you add the file, it was uploaded. If you see nothing \u2014 or only small API calls \u2014 the work is happening locally.<\/p>\n For a full breakdown of the two models and how to verify which one a tool uses, read browser-based vs server-side file processing<\/a>.<\/p>\n If a tool does upload your file, the privacy policy should say:<\/p>\n Vague language like “we take your privacy seriously” or “files are handled securely” is not an answer. Look for a specific retention window \u2014 “deleted within 1 hour”, “removed after 24 hours”. If you cannot find one, treat the file as retained indefinitely.<\/p>\n Check that the URL begins with HTTPS is the absolute baseline. A tool without it should not receive any file you care about.<\/p>\n The input file is one thing; the output is another. Some tools store the results \u2014 extracted text, parsed data, converted files \u2014 on their servers, accessible via a shareable link. That link may be public, guessable, or indexed.<\/p>\n Check: does the result page have a URL you could share? Does the tool send you an email with a download link? Either means the output is on their server. A tool that writes results directly to your browser’s memory and lets you download locally keeps nothing.<\/p>\n A file conversion tool that asks you to sign in with Google, grant access to your Drive, or install a browser extension is asking for more than the task requires. Each of those grants ongoing access that goes well beyond the single file you are trying to process.<\/p>\n Legitimate browser-based tools need no account, no OAuth flow, and no extension. If a tool cannot work without one of those, ask why.<\/p>\n Not all files carry the same risk if they end up on someone else’s server. Before uploading, ask what the file contains:<\/p>\n The higher the sensitivity, the stronger your reason to use a tool that processes the file locally \u2014 or to strip sensitive data before uploading.<\/p>\n2. Does the privacy policy say how long your file is stored?<\/h2>\n
\n
3. Is the connection encrypted?<\/h2>\n
https:\/\/<\/code> before uploading anything. A plain http:\/\/<\/code> connection means your file travels over the network unencrypted and can be intercepted by anyone between you and the server \u2014 your ISP, a coffee shop router, a corporate proxy.<\/p>\n4. What does the tool do with the processed output?<\/h2>\n
5. Is the tool asking for permissions it does not need?<\/h2>\n
6. What kind of file are you uploading?<\/h2>\n
\n