Is it safe to upload photos to an online converter?

The short answer

For a holiday snapshot, uploading to a well-known converter is a low-stakes decision and almost certainly fine. For a passport scan, a bank statement, a medical form, a signed contract or an unreleased product photo, it is a decision you are making on the strength of a promise you have no way to check. That is the honest framing — not "the internet is dangerous", but "you are trusting a claim that is unverifiable by design".

What actually happens when you upload a file

A conventional online converter is a web front end over a server-side pipeline. When you click convert, the file travels to that server, is written to disk or object storage, is read by a worker process, and the output is written back out and served to you. Between those steps, several things exist that most people do not picture:

• The original and the output both sit in storage, usually in a bucket at a cloud provider, for at least as long as your download link is valid.
• Backups and replicas. Object storage is commonly replicated across zones, and buckets often have versioning or snapshot policies. "Deleted after one hour" refers to the primary object; snapshots follow their own schedule.
• Logs. Access logs, CDN logs and error traces routinely record filenames, sizes, IP addresses and timestamps, and they are retained far longer than the files themselves.
• Subprocessors. The converter may not run its own infrastructure. Storage, virus scanning, CDN and error reporting are frequently third parties, each with its own retention policy and its own jurisdiction.

None of this is sinister. It is just what an ordinary server-side architecture entails. But it means "we delete your file after one hour" is a statement about one step in a chain of five.

Three things people consistently underestimate

1. Photos carry your location

A photo taken on a phone contains EXIF metadata: camera model, exact timestamp, and on most phones by default, GPS coordinates accurate to within a few metres. Upload a photo taken in your kitchen and you have uploaded your home address in machine-readable form. This survives most server-side conversions, because a careful converter preserves metadata on purpose — it is usually the behaviour you want, until it isn't.

Worth knowing: any converter built on the browser's canvas — including the ones on this site — drops EXIF as a side effect of how it works. The image is decoded to raw pixels and re-encoded from scratch, and the metadata simply has nowhere to travel. That is a real privacy benefit, but note the trade-off: if you wanted to keep the capture date or camera settings, canvas-based conversion loses them too.

2. The terms of service usually grant a licence

Free file services frequently include a clause granting a licence to store, reproduce and process your content "for the purpose of providing the service". That wording is standard and, read narrowly, unobjectionable — it is what lets them legally write the file to disk at all. The problem is that the scope is defined by them, the wording is broad, and it is the kind of clause that gets rewritten when a company's business model changes or it gets acquired. Read the clause before uploading anything covered by an NDA or a client agreement, because "I put it through a free web tool" is not a defence that survives contact with a legal team.

3. A breach exposes what was there, not what is there now

Retention promises are about the steady state. Breaches are about a moment in time. If a service is compromised on a Tuesday afternoon, everything sitting in its buckets that afternoon is exposed, including your file that was going to be deleted forty minutes later.

So when is uploading fine?

A workable rule: would you be comfortable if this file were posted publicly with your name attached? If yes, upload freely and stop worrying. If no, use something that does not upload.

File	Uploading is…
Holiday photos, memes, screenshots of public pages	Fine
Photos of your home, children, or workplace interior	Consider the GPS metadata first
ID documents, passports, driving licences	Avoid
Bank and medical statements	Avoid
Anything under an NDA or client contract	Avoid — and check the ToS

How to check whether a tool uploads

You do not have to take anyone's word for it, including ours. Two checks, neither of which needs technical background:

1. Watch the network. Press F12, open the Network tab, and convert a file. If the file is being uploaded you will see a request — typically POST — whose size is roughly the size of your file. A page that works locally shows nothing of the sort, only the page's own assets.
2. Go offline. Load the page, disconnect from the network, then try to convert. A server-side tool fails immediately. A browser-side tool keeps working, because everything it needs is already in the tab.

The offline test is the more convincing of the two, because it cannot be faked.

The alternatives, including the ones that aren't us

If a file should not be uploaded, you have three options, and a web tool is only one of them:

• What is already on your computer. macOS Preview converts images through File → Export and merges PDFs by dragging pages in the sidebar. Windows Photos exports JPG via Save as. Neither costs anything or sends anything anywhere.
• A desktop application. IrfanView and XnConvert handle large batches far better than any browser can; ImageMagick's convert is the right answer for scripted work.
• A browser tool that runs locally, which is what this site is. Convenient for one-off jobs, no install, and it inherits the browser's sandbox — but your device's memory sets the ceiling, so it is the wrong choice for a thousand-file batch.

Common questions