How to check that a web tool really keeps your data on your device
"Your data never leaves your device" is easy to write on a web page. With the tools already built into your browser, you can check whether it is true in about five minutes, without being a programmer.
Why it matters
A lot of useful web tools work on personal things: photo converters, PDF editors, tools for your social media exports, password generators. Some do the work on their own servers, which means your file is uploaded. Others do everything inside your browser, and your file stays on your computer. Both can be legitimate, but you should know which one you are using before you open a bank statement or a folder of family photos.
The good news is that a browser cannot hide what it sends. Every request a page makes passes through the browser, and the browser will show you all of them.
Check 1: watch the network
Every desktop browser has developer tools with a Network panel that lists each request a page makes.
- Open the tool's page.
- Press
F12(orCtrl+Shift+I; on a Mac,Cmd+Option+I) and choose the Network tab. - Click the clear button (a circle with a line through it) so the list is empty.
- Now use the tool as normal: choose your file, press the button, wait for the result.
- Look at what appeared in the list.
What you want to see is nothing, or only small requests for things like fonts and icons. What should worry you is a request sent while you used the tool whose Method is POST or PUT and whose size is close to the size of your file. Click on it: the Payload or Request section shows what was sent. If you can see your file's contents or name there, it was uploaded.
Two tips: tick Preserve log so the list is kept if the page reloads, and sort by Size to make large uploads stand out.
Check 2: the offline test
A simpler test, which needs no developer tools at all:
- Open the tool's page and let it load completely.
- Turn off your internet: switch off Wi-Fi, or put your computer in airplane mode.
- Use the tool.
If it still works, the processing really happens on your device. If it shows an error or spins forever, it needs a server. This does not prove anything sinister, since some tools honestly need a server, but it tells you whether the claim "nothing leaves your device" is true.
Check 3: what the page asks permission for
Pay attention to what a tool asks for, compared with what it needs:
- File pickers are safe by design. When you choose a file, the page gets that one file and nothing else on your computer.
- Camera, microphone and location prompts should only appear when the tool obviously needs them, for example a tuner asking for the microphone.
- Browser extensions are different. An extension can be given access to every website you visit. Read the permissions it asks for when you install it, and prefer extensions that limit themselves to the one site they work with.
- Logging in on another site's behalf is a red flag. A tool that asks for your Instagram or email password, rather than working inside your own logged-in browser, has your account.
Check 4: read the privacy page with a purpose
Privacy policies are long, but you only need a few answers. Search the page (Ctrl+F) for "upload", "server", "store", "retain" and "third part". A trustworthy tool says plainly whether files are uploaded, how long they are kept and which outside services, such as analytics or advertising, are on the page. If the answers are vague, assume the worst.
What "on your device" does not cover
Even a tool that never uploads your file is still a web page. Pages commonly load analytics that count visits, and adverts that may use cookies. Those are separate from your file, and a good privacy page lists them. The network check above will show them too, as small requests to other domains. They are about the visit, not about the content of what you worked on.
How mdworks tools handle your data
The mdworks tools are built to work in your browser wherever possible. Unsave runs inside your own logged-in Instagram tab and never sees your password; PostFinder builds the search on your device and opens it on x.com. The privacy page lists exactly what is collected: a count of visits without cookies, and adverts on some pages. You are welcome to run the checks above on any of them.