What happens to a file you upload?
An online converter that works by upload is a program running on the service's own servers. When you choose a file, your browser sends a copy of it to them, usually over an encrypted connection; the server converts it, stores the result and gives you a link to download it. For a while, then, a copy of your file and of the result sits on computers you do not control.
What happens next depends entirely on the service. Reputable ones say in a privacy policy or on a security page how long they keep files, and delete them automatically after that period. Some keep files for longer when you have an account, keep backups or logs, or use outside companies for hosting and processing, and a careful policy says so.
Is it safe?
For most everyday files, from a well-known service with a clear policy, the practical risk is low. Transfers are normally encrypted, files are deleted on a schedule, and a vacation photo or a flyer is not much of a prize. The honest answer is still conditional, because you are trusting the service to do what its policy says, to stay secure against attackers, and to keep those promises if it is sold or changes its terms.
The calculation changes with what is in the file. A tax return, a signed contract, a medical record, a passport scan, or anything covered by a confidentiality agreement is worth more to the wrong person, and your employer or your clients may have rules about where such files can go. For those, the safest upload is the one that never happens.
What should you check before uploading?
- How long files are kept. The privacy policy or security page should say how long uploads and results are stored, and that they are deleted automatically.
- The connection. The address should begin with https, and the browser should show no security warning.
- Who runs it. A named operator, a way to contact them and the country whose laws they follow are signs of a service that expects to answer for its promises.
- What they may do with files. Look for any right to use uploaded content for other purposes, such as improving their products, and for a plain statement that files are not shared or sold.
- Accounts. A service that keeps your files in an account keeps them until you delete them, so delete what you no longer need.
- Metadata. Photos can carry where they were taken, and documents their author's name. Remove EXIF data and the PDF metadata editor remove those on your own device before a file goes anywhere.
How is an in-browser tool different?
Some tools, File4Edit among them, do the work on your own device instead. The site sends your browser its code, which is the program itself, and the program then reads your file from your disk into the tab's memory, converts it there and hands the result back as a download. The file is never sent to a server, so there is nothing to retain, delete, secure or leak on anyone else's computer.
That is a claim you can check rather than take on trust, which is the real difference. Open your browser's developer tools, switch to the Network panel and convert a file: an upload-based converter shows a request carrying your file, and an in-browser tool shows none. Or use a tool once, then disconnect from the internet and carry on; a tool that needs to upload cannot finish the job.
In-browser tools have trade-offs of their own. Very large files are limited by your device's memory rather than a server's, and a browser cannot do everything a server can, such as reading the text in a scan. You also still trust the code the site sends: a dishonest site could upload in the background, which is exactly what the network test would reveal.
Some formats need extra code the first time you use them. File4Edit downloads a HEIC decoder, or its own WebP encoder, from its own site when one is needed; that request fetches code and carries nothing of yours, which the same test shows.
Which should you use?
- For a public photo, a flyer or a file you would happily email to a stranger, any reputable converter is fine, uploading or not.
- For documents with personal, financial, medical or client information, prefer a tool that runs on your device: an in-browser tool that passes the network test, or software installed on your computer.
- Whatever you use, keep the original and check the result before you rely on it.
File4Edit's privacy policy sets out what the site itself does record: one row for each page it serves, holding the time, the page, the country, the linking site and a few coarse words about the browser, but no IP address or cookie, and the messages people choose to send through the contact form.