Zero-upload evidence

Running one typical operation on each tool page produced no request that carried our test input: the browser talks only to this site, and it sends nothing about what you paste. Below is the raw table and the exact method, so you can reproduce it.

Method

We built the site as a static export, served that export from a local static server, and opened one page per tool in a headless Chromium with service workers blocked. For each tool we performed a single typical operation against the real page: we typed an input sentinel into every visible text field and clicked the primary action button, and for the file tools we uploaded a real image and ran the conversion. We then counted every request the page issued, including the page load itself.

Measurement date: 2026-10-20
Environment: @playwright/test 1.58.2 · Chromium 145.0.7632.6 · darwin arm64 · Node v20.18.0

What was measured

One typical operation per tool page, on the English pages (the only locale captured). The table below pairs each tool with the operation that was actually performed and the number of requests observed.

Language captured: en

27 tools

What was measured
Tool	Input	Operation performed	Requests
bmp-to-webp	no input	page load only	33
certificate	text	typed into every visible text field, then clicked the primary action	33
color	text	typed into every visible text field; no primary action could be triggered	33
cron	text	typed into every visible text field; no primary action could be triggered	33
css	text	typed into every visible text field, then clicked the primary action	33
csv	text	typed into every visible text field; no primary action could be triggered	33
diff	text	typed into every visible text field, then clicked the primary action	33
encode	text	typed into every visible text field, then clicked the primary action	33
encrypt	text	typed into every visible text field, then clicked the primary action	34
gif-to-webp	no input	page load only	33
hash	text	typed into every visible text field, then clicked the primary action	34
hmac	text	typed into every visible text field, then clicked the primary action	34
image-compressor	file upload	uploaded a real image, then ran the conversion	48
jpg-to-webp	file upload	uploaded a real image, then ran the conversion	33
json	text	typed into every visible text field, then clicked the primary action	33
jwt	text	typed into every visible text field, then clicked the primary action	33
markdown	text	typed into every visible text field, then clicked the primary action	33
password	no input	clicked the primary action	33
png-to-webp	file upload	uploaded a real image, then ran the conversion	33
qrcode	text	typed into every visible text field, then clicked the primary action	33
regex	text	typed into every visible text field; no primary action could be triggered	34
rsa	no input	clicked the primary action	33
text	text	typed into every visible text field; no primary action could be triggered	33
timestamp	text	typed into every visible text field, then clicked the primary action	33
uuid	text	typed into every visible text field, then clicked the primary action	33
webp-to-jpg	file upload	uploaded a real image, then ran the conversion	33
webp-to-png	file upload	uploaded a real image, then ran the conversion	33

How to read the table

Requests counts every request the page made, the page load included; it is not a count of uploads. The column that matters is the one before it: requests that carried the input sentinel. That number is the honest version of “nothing is uploaded” — it is measured, not asserted. Two rows say page load only, because no fixture of the right input format exists in the repository for those conversions; we publish that reduction instead of inventing a number.

Questions about this evidence

Does this prove that nothing can ever be uploaded?

It proves what it measured: with the network recorded and the page served without a content security policy, no request carrying the test input left the browser during one typical operation per tool. It is a measurement of the artifact in this repository, not a proof about every future version of it.

Why does the request count look large if nothing is uploaded?

Because a request count includes the page load: the document plus its scripts, styles and fonts. Those are requests for code that this site serves, and they carry none of your input. The column that answers the upload question is the input-carrying one.

Which operation was run for each tool?

The same shape for all of them: an input is provided the way a visitor would provide it, then the tool's primary action is triggered. The table names the shape per row, including the rows where only the page load could be measured.