How to tell whether a web tool really runs in your browser

"Your files never leave your device" is a claim, and claims are cheap. The useful thing about this particular claim is that it is falsifiable in about fifteen seconds using a tool already installed in your browser.

The check

Open DevTools. F12 on Windows and Linux, Cmd+Option+I on macOS. Every major browser has this; none of them require an extension.
Go to the Network tab and let the page finish loading.
Clear the request list — the 🚫 icon. You now have a clean slate, so anything that appears from here on is caused by what you do next.
Use the tool. Paste input, click the button, do whatever the tool does.

An empty list means the work happened in your browser. A request means it did not. That is genuinely all there is to it.

What a clean result looks like

On a tool that processes locally, you will see nothing at all after clearing — not a single row. This surprises people, because we are used to the web being a conversation with a server. But a page that has already downloaded its JavaScript has everything it needs; running a hash function or parsing CSV requires no further contact with anyone.

If you want to be thorough, tick Preserve log before you start and leave the tab open for a minute after you finish. Some tools batch their telemetry and send it on a timer or when the page unloads, which a quick look would miss.

Three cases that look ambiguous

1. Requests that appear but are not your data

Ad scripts, fonts and analytics all make requests, and on an ad-supported site you will see them. What matters is what is in them. Click a request, open the Payload or Request tab, and look. An ad call carries the page URL, a size and some targeting parameters. It does not carry your CSV, because the ad script never had access to your CSV — it lives in a cross-origin iframe and cannot read the contents of the page's textareas.

This distinction is worth being precise about, because it is where honest and dishonest sites diverge. A site can carry advertising and still never transmit your input. What it cannot do is carry advertising and claim to make no requests at all.

2. Beacons on page unload

Filter the Network tab by Fetch/XHR and watch what happens when you navigate away. navigator.sendBeacon() exists specifically to fire a request as a page closes, and it is designed not to be noticeable. Preserve log catches it.

3. WebSockets

A WebSocket opens once and then streams messages over the same connection, so a tool that opens one at page load and streams your keystrokes through it shows a single innocuous row in the request list. Switch the filter to WS, click the connection, and open the Messages tab to see what is actually crossing it.

A stronger version of the test

If you want the definitive answer rather than the fast one: load the tool page, then disconnect from the network entirely — turn off Wi-Fi, or tick Offline in the Network tab's throttling dropdown — and use the tool.

A client-side tool works perfectly, because it never needed the network. A server-side tool fails, usually with a spinner that never resolves. There is no way to fake a pass on this test, which makes it the one worth running on anything you actually care about.

It is also a reasonable thing to expect a tool to survive. Every tool on this site does; that is what the request counter in the header is showing you, and you are welcome to check it the hard way.

What the check does not tell you

Two honest limits. First, this tells you what the tool does right now, in this session. A site can serve different code tomorrow, or different code to different visitors. Verification is a habit, not a certificate.

Second, it says nothing about the rest of your machine. A browser extension with permission to read page contents sees your input regardless of whether the site transmits it, and it will not show up in the site's network log. If you are handling something genuinely sensitive, the extension list deserves the same scrutiny as the website.

Neither limit makes the check less useful. It converts an unverifiable marketing claim into an observation you made yourself, which is a large improvement over trusting a sentence on a landing page.