How to check whether an online image tool uploads your photo

People put sensitive things through image tools without thinking about it: scans of ID cards for an application, photos of children, screenshots of bank statements cropped for a support ticket. A phone photo can also carry the GPS position where it was taken. Once a file is uploaded, you are relying on a privacy policy you have probably not read to know what happens to it.

Uploading is not automatically sinister. Some jobs genuinely need a server: browsers cannot write AVIF or .ico files, so the AVIF converter and favicon generator on this site send the image to our own encoder, and say so. The question is whether a tool tells you the truth about it, and you do not have to take anyone’s word for that.

This works in Chrome, Edge, Firefox and Safari. The menu names differ slightly, but the idea is identical.

1. Open the tool’s page, then open the developer tools: F12, or Ctrl+Shift+I on Windows and Linux, or Cmd+Option+I on a Mac. In Safari, turn on the Develop menu in its settings first.
2. Click the Network tab and clear it, so you only see what happens next.
3. Load your image and run the tool as you normally would.
4. Look down the list for a request with the method POST or PUT. Click it and open its Payload or Request tab. An upload shows your file there, and its size will be close to your image’s size.

Plenty of requests are normal. A tool loading its own code, fonts and styles makes dozens of them. Analytics sends small page-view pings, usually a few hundred bytes. Neither carries your image.

Large downloads are not uploads either. An AI background remover that runs in your browser has to fetch its model first, which can be tens of megabytes; ours is 84 MB and comes from this site’s own address. Those show up as GET requests with a big response. The thing to look for is the other direction: a request whose body, not its response, is the size of your photo.

If you see one, the image was uploaded. That may be fine, as long as the site said it would happen.

A quicker second check, with one caveat. Load the tool, let it finish any first-run download, then turn on aeroplane mode or switch off your Wi-Fi and process an image. A tool that does its work on your device carries on. One that needs a server fails.

The caveat is that failing offline does not prove an upload. Some tools load parts of their own code only when you first press a button, and that load fails without a connection even though your image would never have gone anywhere. When the two tests disagree, believe the Network tab.

Some wording only makes sense if the file went to a server. “Files are deleted after one hour” means they were stored for an hour. “Processed securely in the cloud” means processed in the cloud. A download link that arrives by email, or a queue telling you how many people are ahead of you, means the same. None of these are wrong in themselves, but they contradict a “never leaves your device” claim on the same page.

It shows what left your browser during that visit. It cannot show what a server does with a file it did receive, and a site can change its code tomorrow, so it is worth repeating the check now and again for anything sensitive. Browser extensions can also read the pages you visit, so for a passport scan it is sensible to use a window where they are switched off, such as a private window with extensions disabled.

On this site, the background remover, the image compressor and every converter except AVIF and ICO pass the test: you will see the page load and, on the AI tools, the model download, and nothing carrying your image. Try it.