"No upload, 100% private" — we checked what actually happens on the network

“No upload — 100% private — runs entirely in your browser” is one of the most common claims on free image tools right now, and it’s also one of the easiest claims to fake, because most people have no way to check it. A page can say “your images never leave your device” while quietly POSTing the file to a server the moment you drop it in. We tested four popular tools that make this exact claim, using nothing but the browser’s own Network panel, and show the method so you can verify any tool yourself in under a minute.

The method: watch the network, not the marketing copy

Reading a privacy policy or a claim on the homepage tells you what a company says it does. The Network tab in your browser’s DevTools tells you what the page actually does, request by request, the moment you interact with it. The check is the same for any site:

1. Open DevTools (F12 or right-click → Inspect) and switch to the Network tab.
2. Upload or drop in a file, the same way you normally would.
3. Watch what shows up. A tool that’s genuinely processing locally will show blob: URLs (the browser’s in-memory object references) and, for AI-powered tools, a one-time download of a model file (often from a CDN like jsdelivr or unpkg) — but never your actual image data leaving as a POST request to the tool’s own backend.
4. If you see a POST request whose payload is your image file going to the site’s own API, the “no upload” claim is false, regardless of what the homepage says.

What we found testing four “no upload” tools

We tested this on four sites that prominently advertise “no upload” or “100% private, runs in your browser,” using a real file upload and reading every network request that fired:

Tool	Claim	What we saw on the network	Verdict
tinypngnow.com (image compressor)	“No upload, 100% private”	Only blob: object URLs — no request left the browser with image data	Claim holds
compressimage.io (image compressor)	“100% Private… no images are sent to any servers”	Only a blob: object URL	Claim holds
backgroundless.io (AI background remover)	“100% private client-side editing”	Downloaded onnxruntime-web from a CDN, then ran inference locally — no image upload	Claim holds
rmbg.dev (AI background remover)	“100% Private”	Downloaded onnxruntime-web (WebGPU build) from a CDN, then ran inference locally — no image upload	Claim holds

All four held up. The two background removers were the more interesting case: removing a background is computationally heavy and traditionally required a server-side AI model, so “runs in your browser” for that specific category is a newer and less obvious claim to verify — both tools we tested back it up by loading ONNX Runtime Web, a real WebAssembly/WebGPU inference engine, and running the segmentation model on-device instead of calling an API.

An honest result isn’t a non-result

We’re not going to manufacture a “gotcha” that isn’t there — all four tools we checked did what they claimed. That’s a legitimate finding, not a disappointing one: it means the specific claim “no upload, 100% private” is, at least among the sites we tested, being used accurately rather than as an empty marketing phrase. It also means the check itself is worth doing yourself rather than trusting our sample of four — we tested a handful of tools, not the hundreds of pages making this claim across the web, and a tool’s backend can change after publication in a way a snapshot like this can’t catch.

Why this distinction actually matters

A tool that genuinely processes your file locally has a structurally different privacy posture than one that uploads it, even temporarily: there’s no file sitting on someone else’s server, no transfer to intercept, and no server-side retention policy to trust. This is also exactly how the tools on this site work — our Image Compressor and Image Resizer process files entirely in your browser via the same kind of client-side JavaScript, and our Password Generator never sends the password it generates anywhere, for the same structural reason. You don’t have to take that claim on faith either — the check above works exactly the same way here.