Image converters are one of the most-searched tools on the web — and one of the least scrutinised. Most of them are free, anonymous, and quietly upload everything you give them to a server. For a holiday photo that is fine. For a passport scan, a payslip, or a medical image, it is a problem.
How most online converters work
The traditional architecture is: your browser uploads the file to a backend server, the server converts it using ImageMagick or a similar tool, then the converted file is offered back as a download. Sometimes the original is deleted after a short window. Sometimes it is not. There is no way for you to verify either way.
What that means for your privacy
- The provider's servers see and store your image, at least temporarily.
- Files can be intercepted in transit if the connection is not HTTPS — most are, but check.
- Some providers explicitly use uploaded images to train models or for analytics.
- Files can be exposed via misconfigurations, data breaches, or insider access.
- GPS coordinates and other metadata travel with the image unless stripped.
Browser-based conversion is fundamentally different
A browser-based converter does the conversion inside your browser, using JavaScript and Web APIs like Canvas, WebCodecs, or WebAssembly. The image never travels over the network. The provider's server only ever sees the HTML and script files needed to load the page — not your image.
You can verify this yourself. Open the browser's developer tools, switch to the Network tab, and watch what happens when you convert a file. If no upload request appears, no upload happened. ImageToAnything works this way.
What to check before uploading anywhere
- Does the site explain how files are processed? "In your browser" should be specific and easy to verify.
- Is there a clear privacy policy that names what data is collected?
- Do they mention retention times? "Deleted after 1 hour" is fine; "may be retained" is not.
- Are they upfront about ads and analytics? Both are normal; hiding them is not.
- Does the site work without an account? Personal data should never be required to convert a JPG.
Image metadata: the invisible passenger
Most photos carry EXIF metadata: camera model, lens, exposure, date, and often GPS coordinates pinpointing exactly where the photo was taken. Sharing a photo without stripping EXIF can leak your home address, your child's school, or your daily commute.
Most browser-based converters either strip metadata by default or give you a clear option to do so. If you are converting personal photos for public sharing, always remove location data first.
Frequently asked questions
Is it safe to convert ID documents online?+
Only if the converter runs in your browser. Anything that uploads your file to a server is a privacy risk for sensitive documents.
How can I tell if a converter is browser-based?+
Open dev tools, go to Network, then convert a file. If no upload request appears for the image, it is local.
Does HTTPS make uploads safe?+
HTTPS protects the file in transit. It does not stop the receiving server from storing, reading, or selling the file.
What is the safest way to convert an image?+
Use a tool that does the conversion locally in your browser, strips metadata by default, and does not require an account.