Privacy ·
How to audit the Network tab to verify zero-upload privacy
Claims of “we never upload” are testable. Open DevTools, preserve the log, convert a uniquely sized file, and inspect Fetch/XHR and document requests. If a request body matches the file, the claim is false. If you only see static assets and maybe an ad iframe, the file stayed on-device. Run this on merge PDF, SHA-256, or any converter before you trust it.
Prepare the lab
Empty the Network log, enable Preserve log, filter Fetch/XHR. Note your file’s exact byte size on disk. Use a dummy file if you do not trust the origin. Unique sizes (e.g. 1,337,921 bytes) are easy to spot in the size column.
Disable cache so you see the real JS download. That is not the file. People confuse a 2 MB bundle with a 2 MB PDF. Compare MIME types: application/pdf or multipart/form-data versus application/javascript.
What legitimate requests look like
JS chunks, CSS, fonts, maybe /blog/rss.xml, AMP ad iframe. Sizes are kilobytes to a few megabytes for the app, not a 40 MB PDF posted as multipart. On Tools Without AI, hashing in SHA-256 checksum and merging in merge PDF should look like this quiet pattern.
Payload inspection
Click a request → Payload / Request. multipart/form-data with filename= is the smoking gun. JSON with a base64 field the same length as your file is the same gun with extra encoding — see Base64 vs Blobs. A 4/3 size bump is a tell.
Beacons and workers
navigator.sendBeacon, fetch keepalive, and hidden pixels. Filter by method POST/PUT. Check WS frames if a “collaborative” editor is open. Service workers can rewrite URLs; open Application → Service Workers.
Repeat in Firefox and Safari
Engines differ. Safari’s Network panel is enough to see a POST. Corporate telemetry is what you are preventing. Canvas compress and PDF merge articles assume you will run this test once.
After the test
If the origin is clean, use the local tool. If it is not, do not “just this once” for a bank PDF. Data minimization is a habit, not a badge on the homepage.
Worked example: three tools, one dummy file
Create a 1,337,921-byte dummy PDF. In Chrome, Preserve log, filter Fetch/XHR. Run merge PDF (merge it with itself or a second dummy). Look for 1337921 in sizes. Repeat on SHA-256 checksum and image compressor with a dummy JPEG of a unique size.
You will see JS and maybe ads. You should not see multipart. If you see Base64 in a JSON body, decode length × 3/4 — Base64 vs Blobs. That is still an upload.
Safari: same dummy, Web Inspector. Firefox: same. Corporate policy can require a screenshot of this panel in a ticket. That is more useful than a vendor’s “we delete in 24h.”
After you trust an origin, still do not paste production JWTs into it unless it is your JWT inspector and you understand decode vs verify. Files and tokens are different classes; both are testable.
Frequently asked questions
Can a service worker hide an upload?
It can intercept fetch. Inspect the Service Workers panel and still watch Network with Preserve log. sendBeacon is another method to know.
Will a HAR include my file?
HAR includes request bodies if they were sent. If nothing was sent, the HAR should not contain the PDF. HARs can still contain cookies — treat them as sensitive.
Do ads count as an upload of my document?
Ad requests are not your document unless the page attached it. Check payload sizes against the file size. Minimization is about the file, not the existence of ads.