8 browser tools that never upload your files
Client-side browser tools for images, PDFs, audio, and more: processing stays on your device. How to verify with the Network tab, plus honest contrasts with upload-first converters.
Most "online tools" upload your file. You drop a PDF or a photo into a form, a spinner appears, and the bytes land on someone else's server. Often that is fine. Sometimes it is not: contracts, medical scans, client assets you never meant to park on a random converter.
Another class of browser app does the work in the tab with JavaScript and WebAssembly. For the job you asked for, the file never leaves the device. No upload step. No "we delete after 60 minutes" policy to take on faith.
This is a short privacy shelf from Linkstore: eight tools that earn the claim, plus how to check for yourself.
How to verify (30 seconds)
Landing pages love "private" and "your files stay yours." Those words do not mean the same thing.
Open DevTools → Network. Clear the log. Drop the file. Run compress / merge / convert. A large POST carrying your file to a third-party host means that job is not client-side. Small telemetry pings or CDN hits for the _app code_ are normal. Your document leaving the machine is not.
If the listing also claims Offline, load the app, cut the network, retry the job. If it still works, processing never depended on a server round-trip. Installable alone does not prove that.
The shortlist
1. [Squoosh](/apps/squoosh-3452018626): images
Google's side-by-side compressor (WebP, AVIF, MozJPEG) with live quality sliders. Processing stays on your machine. Offline works. Install it if you ship images most weeks.
Limitation: One image at a time. Last-mile compress before deploy, not a DAM.
2. BentoPDF: PDFs
Merge, split, compress, rotate, watermark, sign, convert: a PDF toolkit that runs in the browser with no account. The Utilities pick when you refuse to feed a random converter.
Limitation: Not every Acrobat edge case. Still beats upload-first defaults for confidential PDFs.
3. AudioMass: audio
Waveform editor: cut, fade, normalize, EQ, record in the tab. No account. Listing describes fully client-side processing: open, edit, export.
Limitation: Not a full DAW. Multitrack music wants something heavier. A pinned tab is enough for occasional use.
4. [CyberChef](/apps/cyberchef-9602050202): transforms
GCHQ's "cyber Swiss army knife": chain base64, hex, compression, hashing, parsing into recipes. Transforms run in the tab. Magic mode guesses encodings.
Limitation: Dense UI on first open. Huge inputs can freeze the tab. For highly sensitive paste jobs, some people prefer a local offline build.
5. [PairDrop](/apps/pairdrop-2582411798): local-network share
AirDrop-shaped sharing across platforms: same-network devices exchange files in the browser. This is not "upload to PairDrop's cloud." Peer transfer with a local-network bias. Different story than a WASM compressor, still the right tool when the goal is "get this file to that laptop without Dropbox."
Limitation: Needs network visibility between devices (or pairing). Not an archive.
6. [Excalidraw](/apps/excalidraw-7518537263): local boards
Hand-drawn diagrams cheap enough to throw away. Local boards work offline; collaboration rooms need a network. For sketches that should not become a SaaS scrapbook, stay local by default.
Limitation: Not Figma-class product design. Wrong tool for pixel-perfect UI kits.
7. Super Productivity: local-first tasks
Todo list and time tracker with data on the device. Jira/GitHub hooks when you want them. Offline-capable. Not a glossy team suite. That is the point.
Limitation: Utilitarian UI. Different privacy story than "file never uploaded once," but still a local-first win for personal work.
8. VERT.sh: convert (mostly local)
Open-source converter: images, audio, and documents via WebAssembly on-device. Honest hybrid: heavy video jobs may touch a server. Verify that path in Network before you drop a confidential reel. Installable; Utilities shelf.
Limitation: Video is not the same guarantee as local image/doc convert. Treat modes separately.
Honest contrasts (not on this shortlist as "truly local")
Photopea: hybrid, be careful
Photopea is a Photoshop-shaped editor in a tab: PSD, layers, masks. A lot of editing stays in-browser. Do not treat it as "no upload forever for every feature." Cloud or AI-ish paths and account-tied extras can change the story. Pure compress with no upload → Squoosh. Layered PSD surgery in-tab → Photopea. Check Network if a specific export path matters for a confidential brief.
TinyWow and CloudConvert: server-side, say so
TinyWow and CloudConvert are useful. They are also server-side. Files leave your machine; retention is theirs to honour. We keep them in the catalogue for one-off converts when the document is not sensitive. This article will not rebrand them as client-side.
Same rule for any "AI PDF" that needs a GPU farm. If Network shows the file leaving, it does not belong in the local column.
When upload-first is still fine
Client-side is not a purity test. Real-time multiplayer needs servers. Heavy AI inference often needs GPUs you do not have in a laptop tab. Obscure formats and API automation still favour cloud converters. Match the tool to the threat model and the job.
If you build local-first tools
Say so with evidence: "processing in the browser via WebAssembly," not only "privacy-friendly." Call hybrids in one sentence. Earn Installable and Offline with real manifests and caches.
Submit free or check Pricing for paid options. A slot in an editorial shortlist is not for sale.
The point
Privacy talk is cheap. The Network tab is not. Start with Squoosh or BentoPDF on a file you care about, watch what leaves, and keep the tools that pass.
Browse neighbours in Utilities and Developer Tools.