We tested 20 of the most popular "free online file tools" — the ones that come up first when you search for things like "compress PDF free" or "convert MP4 online." The results were uncomfortable.
17 out of 20 uploaded files to a remote server. Of those, 9 offered no clear information about how long files were retained. 4 had privacy policies that explicitly allowed using uploaded content for "service improvement."
How we tested them
The method was simple: open DevTools, go to the Network tab, upload a test file, and watch what gets sent where. For each tool we recorded:
- Does any file data leave the browser?
- What server/domain receives it?
- Is the server in the same jurisdiction as the company?
- What does the privacy policy say about file retention?
What we found
The pattern was consistent across nearly all of them. Here's what the typical upload looks like in DevTools:
POST https://api.somefreetool.com/upload
Content-Type: multipart/form-data
# Your entire file being sent to their server
------WebKitFormBoundaryXYZ
Content-Disposition: form-data; name="file"; filename="my-contract.pdf"
Content-Type: application/pdf
# [Your file data here, now on their server]The privacy policy fine print
Several sites had language in their privacy policies that was alarming once you actually read it:
- "We may use anonymised content to improve our services"
- "Files are stored on secure servers and deleted after 2 hours" — but what happens in those 2 hours?
- "By uploading, you grant us a non-exclusive licence to use your content" — for a file tool?
None of these statements are necessarily malicious — but they illustrate that "free" tools often have data economics baked in.
Three tools that didn't upload
In fairness, 3 of the 20 tools we tested processed files locally. All three were open-source projects. The commercial tools in our sample all used server-side processing.
Browser-based processing is harder to build and doesn't give the operator visibility into what users are processing — which removes a potential data asset. It's not commercially incentivised, which is why few companies do it.