Skip to content
Upload Nothing runs in your browser

How Upload Nothing works

The page you load is static. The file you drop is read by a script in the tab, usually inside a worker, and the download is a local blob. This page names the libraries and the check you can run yourself.

Diagram of a file staying inside the browser tab

How to verify nothing is uploaded

  1. Open a tool page and let it finish loading.
  2. Turn on airplane mode, or disconnect Wi-Fi.
  3. Drop a file and run the tool. It still finishes, because the engines were already downloaded from this site.
  4. Or leave the network on, open DevTools, choose Network, and run the tool. You should see no upload. Requests are GETs for this site’s own scripts, and only for ad or analytics hosts when those features are switched on.

What runs where

PDF editing uses @cantoo/pdf-lib 2.11.1 (MIT). Rendering and text extraction use pdfjs-dist 6.3.289 (Apache-2.0). Image encoding uses the jSquash single-threaded builds of MozJPEG, OxiPNG, libwebp, and a Lanczos resizer (Apache-2.0 wrappers). HEIC decoding uses heic-to 1.5.2 (LGPL-3.0), loaded unmodified as its own chunk the first time you convert a HEIC. ZIP files use fflate (MIT). Workers talk through Comlink (Apache-2.0). EXIF reading uses exifr (MIT). The offline cache uses Workbox (MIT). The signature font is Caveat (SIL OFL 1.1), self-hosted.

Source for the HEIC library: https://github.com/hoppergee/heic-to. It is not patched. If that license ever becomes a problem, HEIC support can be removed without touching the other tools. Notices are also kept in the licenses folder of the repository.

What is deliberately absent

There is no cross-origin isolation. Shared-memory threads would be faster and would also block the ad frames, so the codecs stay single-threaded. There is no error tracker. A failure shows a code on the page and, if analytics is configured, that code only. Filenames and file bytes are not in the event.

The content security policy allows workers and connections to this site. Ad, consent, and analytics hosts are added only when the matching environment variable is set. The policy is enforced, not report-only.

Related tools

  • Privacy

    Cookies, ads, and the files that never arrive.

  • About

    Who runs the site and how it is paid for.

  • compress pdf

    The tool most people use to try the airplane-mode check.

  • Offline

    The page the service worker shows when a route is not cached yet.

Last updated 2026-09-26. By Tam.