Why processing files in the browser is more private (and what that does not guarantee)

By Marcelo Amantino · published October 5, 2026 · 3 min read · who we are

When you use a website to merge PDFs, convert a photo or compress a video, your file usually follows one of two paths: either it is uploaded to a server, processed there and sent back, or it never leaves your device and the work is done by your own browser. The difference matters for privacy, and it is easy to check.

The two paths a file can take

In the upload model, the site receives a copy of your file. It stays, at least for a while, on the infrastructure of whoever runs the service, and the protection of that file depends on their policy, their security and their promise to delete it.

In the local model (also called client-side), the browser downloads the tool’s program and runs everything on your computer or phone. The file is read from your memory, transformed there and the result is saved on your device. No copy goes to the site’s server.

Why this matters in practice

In many cases the file is harmless. In others it is not:

Contracts, medical tests, statements and personal documents that you do not want to hand to a third party just to merge two pages.
Family photos and photos of children, which do not need to go through an outside service to change format.
Client or work files, subject to confidentiality or data protection rules such as the LGPD or the GDPR.
Use on poor networks: with no upload and download, the operation does not depend on your connection speed.

How to confirm it yourself, in two minutes

You do not have to take anyone’s word for it. You can check whether a file is being uploaded:

Open the tool and press F12 (or right-click, “Inspect”) to open the browser’s developer tools.
Go to the “Network” tab and clear the list of requests.
Load your file and run the operation.
Watch the list: if no large request (the size of your file) goes out to the internet, the processing was local.

What local processing does not guarantee

Being honest about the limits is part of privacy. Running in the browser settles the question of the file, but it does not settle everything:

The site can still measure the visit: page accessed, device type and interaction with ads. On WebFaz this is done by Google Analytics and Google AdSense, and you can manage consent under “Cookie preferences”, in the footer. Those services see the visit, not the content of your files.
Some features need a server by nature. One example is audio transcription with a large AI model, which does not run with good quality in the browser. In those cases the site should tell you, before use, what is sent and to whom. On WebFaz, these exceptions are listed on the Privacy page.
Browser extensions and malicious programs on your computer still see what you open. The gain is against the tool’s server, not against a compromised device.
Local does not mean instant: the heavy work is now done by your device, so large files depend on the memory and processor you have.

How to choose an online tool more safely

A few simple questions help you decide before uploading an important file:

Does the site clearly say whether the file is uploaded or not, and where to?
Is there a privacy policy that describes the exceptions, and not just a marketing sentence?
Does the result in the “Network” tab confirm what the site promises?
For your case, is it worth the risk? For a sensitive document, always prefer a local option.