Is it safe to use online file converters? What "no upload" means

An online file converter is as safe as the server you send your file to. If the tool uploads your file, a copy now sits on someone else’s computer, and you have to trust how they store it and when they delete it. If the tool works locally in your browser, the file never leaves your device, and there is nothing on a server to trust.

The trouble is that both kinds look the same: a web page with a button. This post explains the difference and shows you how to check any tool yourself.

Two kinds of online tool

Upload-based tools send your file to a server. The server does the work and sends back the result. Your browser is only the front door. While the file is on that server, whoever runs it can read it, and you can’t see when it is deleted.

Local tools send the program to you instead. The page downloads the code that does the work, and then runs it in your browser, on your own computer. Your file is read from your disk into the browser’s memory, worked on there, and saved back to your disk. It never travels across the network.

Neither is automatically bad. An upload can be fine for a holiday photo. For a contract, a payslip, a medical letter or a passport scan, local is the safer default, because there is simply no copy anywhere else.

How to check a tool yourself

You don’t have to take any site’s word for it, including ours. Every desktop browser has a tool that lists what a page sends and receives.

1. Open the tool’s page.
2. Open the developer tools. In most browsers, press F12, or Cmd-Option-I on a Mac.
3. Choose the Network tab.
4. Let the page finish loading, then clear the list so you start from empty.
5. Use the tool on a file. Pick a file you don’t mind about for this test.
6. Watch the list as you open, convert and save.

What you are looking for is a request that goes out carrying your file. Signs of an upload:

• a request with the method POST or PUT appearing right after you pick the file;
• a request size close to your file’s size, for example 4 MB going out after you chose a 4 MB PDF;
• a progress bar labelled “uploading” while those requests run.

A local tool may still load things while you work: more of its own code, fonts or icons. Those come in to your browser. That is normal. The question is whether your file goes out.

How Madosuite keeps your files

Madosuite runs a Linux machine in your browser, on your own device. When you press Upload in its Files app, the file is copied from your computer into that machine’s home folder, which lives in your browser’s storage. The word is “upload”, but nothing is sent to us. The apps open the file from that folder, and when you download the result, it goes from that folder back to your disk.

Two things follow from that:

• Clearing the site’s data deletes your files. If you clear the browser’s data for Madosuite, its home folder goes with it. Download anything you want to keep.
• No account is needed. You can sign in with 0cloud if you want to, but you don’t have to for any of this.

You can run the Network tab check on Madosuite too. Open a PDF in the PDF app, redact it, save it, and see what goes out. Our step-by-step guide to redacting a PDF without uploading it is a good file to test with, and so is a raw photo you convert from CR3 to JPG.

You will see one connection that stays open: a WebSocket to our relay. It is the Linux machine’s way to the internet, because a browser tab cannot open network connections the way a computer does. It carries what programs on the machine send, such as a package download you start in the Terminal. Saving or exporting a file in an app does not send that file over it.

The exception: sharing in Fig

There is one place in Madosuite where a file is uploaded on purpose: online sharing in Fig, the interface design app you add from the Store.

• Share > Online uploads the file to a server. By default that is the public server at collab.craftapps.dev, and a different server can be set instead. The file stays there after you stop sharing, until you remove it or nobody has opened it for 30 days.
• It is not end-to-end encrypted. The connection is encrypted, but the server stores the file unencrypted, and whoever runs the server can read it.
• The link is the access. There are no accounts: anyone with an edit link can change the file, anyone with a view link can open it.
• Share > Local network uses no server. Your app hosts the session and others connect to it directly. It is not encrypted either, so use it only on networks you trust.

Fig works offline until you share or join a file. If you never use Share > Online, nothing is uploaded. If a design is confidential, use Share > Local network or don’t share it online at all.

Limits of “local”

Local is not the same as invisible. The file is still on your device, so anyone with access to your computer and your browser profile can reach it. And local tools still have bugs: the apps in Madosuite are open-source projects in early stages, so check your results before you rely on them.

The apps are the ArtCraft team’s open-source Crafting Apps (MIT or Apache-2.0), shipped in Madosuite under Madosuite names, so anyone can read how they handle files.

For more on how files are stored, see the FAQ, or try a local tool now with redact a PDF.