Your Files Never Have to Leave Your Computer

The moment you paste a document into a website, you have shared it

You have a PDF contract that needs two pages removed. You search for "remove pages from PDF", click the first result, upload the file, download the result, and close the tab.

The task took ninety seconds. What also happened, invisibly, is that a complete copy of a signed contract now exists on a server belonging to a company you had never heard of two minutes earlier, under a retention policy you did not read, in a jurisdiction you did not check, accessible to staff you cannot name.

This is not a story about malice. Most of these services are run by ordinary people who genuinely delete files after an hour. The problem is structural: you have no way to verify any of it, and the risk does not scale with the difficulty of the task. Merging two PDFs is trivial work, and it can still mean disclosing a document you were contractually obliged to protect.

The useful thing to understand is that for a large class of these tasks, uploading is not technically necessary at all.

What the browser can already do

The assumption that file processing requires a server is roughly a decade out of date. Modern browsers are capable runtime environments, and several standards landed specifically to make local file handling possible:

• The File API lets a page read a file the user selects, as raw bytes, without transmitting it.
• Canvas and createImageBitmap decode and re-encode images using the same code paths the browser uses for rendering.
• Web Workers run heavy processing on a background thread, so the interface stays responsive.
• WebAssembly runs compiled C, C++, or Rust in the browser at near-native speed — which is how mature libraries for PDF manipulation, image codecs, and compression got there.
• The Web Crypto API provides real cryptographic primitives, including a properly seeded random number generator.

Together these cover a surprising amount of ground. Merging, splitting, and reordering PDF pages. Converting between image formats. Resizing and compressing. Generating QR codes. Formatting and beautifying code. Counting and analysing text. Hashing. Encoding and decoding. Generating passwords. None of it needs a round trip.

How to tell where the work is happening

You do not have to take a site's word for it. Two checks take under a minute each.

The network tab

Open your browser's developer tools with F12, select the Network tab, then use the tool normally with a file. Watch what appears.

If processing is local, you will see the page's own assets load and then nothing further of significance — no request carrying your file's worth of bytes. If it uploads, you will see a POST request whose size is comparable to your file, and the tool will typically not produce a result until that request completes.

The size column is the giveaway. A 4 MB request appearing the instant you click "convert" is your document leaving.

The offline test

Even simpler: load the page, then disconnect from the internet — turn off Wi-Fi, or use the "Offline" throttling option in the Network tab — and try to use the tool.

If it still works, the processing is unambiguously happening on your machine. There is no way to fake this. If it fails or hangs, it needed a server.

This test has a pleasant side effect: tools that pass it also keep working on a bad connection, on a plane, or when the operator's server is down.

When a server genuinely is required

Intellectual honesty matters here, because "everything can be local" is not true, and a tool that claims otherwise is either lying or doing something worse.

A server is legitimately necessary when:

• A large machine-learning model is involved. Some models now run in-browser, but many are too large to download or need hardware the average machine lacks.
• External data is needed. Live exchange rates, a domain's DNS records, a page's SEO metadata — the tool has to fetch something it cannot know locally.
• The format needs a heavyweight engine. Full-fidelity Office document conversion, for instance, effectively needs a real office suite.
• Something is stored or shared. If a link must persist for someone else, the data has to live somewhere.

The reasonable expectation is not "never upload" — it is that a tool should be honest about which category it falls into, and should not upload when it does not have to. If a tool that merely resizes an image insists on a server, that is a decision made for the operator's convenience, not yours.

What to think about before uploading

Sometimes uploading is the only option. In that case a few questions are worth thirty seconds:

1. What is actually in this file? A landscape photograph and a scanned passport are the same kind of file and entirely different decisions.
2. Am I allowed to disclose it? Client work, employment contracts, medical records, and anything under an NDA often carry obligations that a quick upload silently breaches.
3. Can I redact first? Cropping out the account number, or replacing real names with placeholders before processing, frequently removes the entire risk.
4. Is there a stated retention period, and does the operator have a name? An anonymous tool with no privacy policy and no identifiable operator is not a service, it is a stranger.
5. Would I email this file to that operator directly? Because functionally, that is the transaction. The upload form just makes it feel different.

One more thing specific to images: photographs carry EXIF metadata, which routinely includes GPS coordinates, the exact capture time, and the device serial number. People sharing a photo of something innocuous have published their home address without realising it. Most editing operations strip EXIF as a side effect, but it is worth knowing the data is there before you post the original anywhere.

PDFs deserve their own warning

PDF is the format where people most often assume a document is a flat picture of a page. It is not. A PDF is a structured document that can contain the full editing history of its text, embedded fonts, invisible layers, form field values, attached files, and complete author metadata.

Two consequences follow, and both bite regularly:

Drawing a black rectangle over text does not redact it. The rectangle is a graphic placed above the text; the text is still in the file, still selectable, still extractable by any tool that reads PDFs. This has produced repeated real-world disclosures of information in documents released by governments and law firms. Genuine redaction requires removing the underlying content, not covering it.

Metadata survives everything. Author name, the software used, creation and modification timestamps, and sometimes a local file path revealing a username and folder structure. It travels with the file through email, uploads, and printing to PDF.

Before sending any PDF outside your organisation, check the document properties. It takes five seconds and occasionally saves a great deal of embarrassment.

How we build these tools, and why

Every tool on AeroTools that can run locally does. The PDF Merger and PDF Studio manipulate PDF structure in the browser using WebAssembly. The Image Converter and Smart Image Compressor decode and re-encode through canvas. The Password Generator draws from the Web Crypto API. The Word Counter, Code Beautifier, and Text Tools never see a network request at all.

You do not have to believe that. Run the offline test on any of them.

Where a server genuinely is required — the AI-based background remover, which needs a model too large to ship to the browser — we say so on the page rather than burying it, because a claim of local processing is only worth anything if it is not applied to things where it is false.

A practical default

Ask what the tool needs to know to do the job. Resizing an image needs the pixels. Merging PDFs needs the page structure. Generating a password needs nothing at all.

If the job requires no external information, the work can happen on your machine, and a tool that uploads anyway has chosen to. That does not make it malicious. But given a choice between a tool that keeps your file local and one that does not, for identical output, the choice is not difficult — and now you know how to tell which is which in under a minute.