Why "we don't upload your photos" isn't enough
A sentence on a web page can't tell you what the page's code does. Even an honest claim can miss the details that matter:
- Some formats are hard to handle in a browser. Services often process simple formats locally and send harder ones, such as iPhone HEIC photos or very large images, to a server.
- "Processed locally" can still leak. A tool can resize your photo on your device and still report the file name, camera model or location to an analytics service.
- Sites change. The code you get today may not be the code the privacy page described.
- Anything you type counts too. A QR code for a Wi-Fi network contains the password, and a contact card contains a phone number.
What you can check is what your browser actually sends. Every request a page makes passes through the browser, and every desktop browser will show you the full list.
How Design Bench handles your images
We checked this against our own page code and then tested every tool (results below). Design Bench has no upload endpoint. When you choose an image, the browser reads it into the tab's memory. From there:
- Resize, Compress, WebP → PNG and Remove EXIF draw the image onto an HTML canvas and export a new file with the browser's own image encoder. Re-encoding is what strips the metadata. The EXIF tool then scans the new file for EXIF and XMP blocks before it lets you download.
- HEIC → JPG uses the open-source heic2any decoder, which is downloaded from our own domain when the page opens (about 1.35 MB) and runs in the tab.
- QR codes, palettes and gradients are generated in the page from what you type or pick. Wi-Fi passwords and contact details stay in the page.
- Previews and downloads use
blob:links, which point to memory inside your browser. You will see them in the Network panel; they are not network traffic.
Every request a Design Bench tool page makes
| When | What | Sent to | Your image in it? |
|---|---|---|---|
| Page opens | The page, style.css, the tool script (app.js, exif.js or the QR scripts), and the icon. The HEIC page also loads heic2any. | pixdesk.cc | No |
| Page opens | Fonts. The pages use system fonts already installed on your device, so no font files are downloaded. The Resize and Compress pages draw their sample photo in the browser; it is not downloaded either. | (nothing) | No Until 19 October 2026 the tool pages loaded Outfit, DM Mono and Fraunces from Google Fonts; that request is gone. |
| Page opens | analytics.js, a consent-based analytics script shared across Toolwoven sites | pixdesk.cc | No It only runs on toolwoven.com addresses. On pixdesk.cc it stops on its first line, so Google Analytics is not loaded and no consent banner appears. |
| Page opens | account.js, the optional "Sign in" button | pixdesk.cc | No When you're not signed in it makes no further requests (confirmed in our test). |
| While you use a tool | Nothing over the network. Only blob: reads of images already in memory. | (your browser) | Stays local |
| Only if you choose to sign in | Sign-in link, session refresh, subscription status | rmwncsegjusfzlyefbct.supabase.co | No These requests carry your email address, a session token and the site name. They contain no images, file names or typed tool content. (We read this from the code but did not test a signed-in session.) |
Check with your browser's Network panel
The routine is the same everywhere. Open the tool, open the Network panel, keep the log, clear it, then process a test image and read what appeared.
- Pick a harmless test photo and note its size, for example 2.4 MB. A photo of a wall is fine.
- Open the tool page, then the Network panel (shortcuts below).
- Turn on log preservation and clear the list.
- Use the tool: choose the photo, convert or clean it, and download the result.
- Filter to Fetch/XHR, the channel pages use to send data in the background. Then switch back to All.
- Hunt for anything that sends data. Show the Method column and look for
POSTorPUT. An upload is a request whose sent size is close to your photo's size, oftenmultipart/form-data.
blob: or data: are the browser reading memory it already holds, such as your preview image. And Chrome's Size column is the size of the response, what came back. To see what was sent, open the request and check its payload or the content-length request header.Try it on this page first
This guide loads only itself and its icon. Open your Network panel, clear it, and try both buttons. The first reads a file locally, so no row should appear. The second deliberately sends a short piece of dummy text to our server, so you can see what a real upload looks like.
Google Chrome
also Edge, Brave, Opera · DevTools- Open DevTools: Cmd+Option+I on Mac, Ctrl+Shift+I or F12 on Windows and Linux. You can also use the ⋮ menu, then More Tools › Developer Tools. Select the Network tab.
- Tick Preserve log, then clear the list with ⊘.
- Click Fetch/XHR in the filter bar. Check WS as well, because WebSockets can stream data. Then go back to All.
- Right-click a column header and enable Method.
- Click a request. Under Headers › Request Headers, look for
content-length. The Payload tab appears only when something was sent, and shows exactly what. - Offline test: choose Offline in the Network throttling drop-down next to Disable cache. It normally reads No throttling.
Official docs: Open Chrome DevTools · Network features reference. Labels checked on 19 Oct 2026. If Chrome has moved a control since then, the reference page names its new place.
Mozilla Firefox
Network Monitor- Open the Network Monitor: Cmd+Option+E on Mac, Ctrl+Shift+E on Windows and Linux. You can also use Tools › Browser Tools › Web Developer Tools, then the Network tab.
- Open the menu of other actions (the gear icon at the right of the toolbar) and turn on Persist Logs. Clear the list with the bin icon.
- Filter with XHR for background requests and WS for WebSockets, then go back to All.
- Watch the Method, Transferred and Size columns. Right-click a header to add columns.
- Click a request. The Request tab shows the body that was sent, and Headers shows
Content-Length. - Offline test: choose Offline in the Throttling menu on the toolbar.
Official docs: Network Monitor · Toolbar · Request details · Throttling. Checked 19 Oct 2026.
Apple Safari
Mac · Web Inspector- One-time setup: Safari › Settings… › Advanced, then tick Show features for web developers.
- Press Option+Cmd+I (or choose Develop › Show Web Inspector), then open the Network tab.
- Tick Preserve Log and clear the list.
- Use the type buttons above the table: XHR/Fetch, then All.
- Right-click the table header and tick Method.
- Select a request. In Headers, a Request Data section appears only when something was sent. The Sizes panel shows Bytes Sent separately from Bytes Received.
- Offline test: Web Inspector has no offline switch, so turn off Wi-Fi or unplug the cable.
Official docs: Enabling Developer Features (Apple) · Enabling Web Inspector · Network Tab. XHR/Fetch, Request Data and Bytes Sent were checked in WebKit's Web Inspector source on 19 Oct 2026.
The offline test
If a tool still converts your photo with the network switched off, the conversion can't be happening on a server. It is the easiest test to show a colleague.
- Open the tool page while you're online and wait for it to finish loading.
- Go offline: use the browser's Offline setting (above), or turn off Wi-Fi.
- Without reloading, choose a photo and run the tool. If you get a download, the work happened on your device.
- Leave the Network panel open, with the log kept, while you reconnect. A tool could store data and send it later, and this is how you'd see it.
Design Bench offline results
| Tool | Test input | Offline straight after the page loads | Output while offline |
|---|---|---|---|
| Image Resizer | 800 × 600 JPG → 400 px wide | Works | 400 × 300 WebP |
| Image Compressor | 800 × 600 JPG | Works | WebP, about 5 KB |
| HEIC → JPG | 800 × 600 HEIC | Works | 800 × 600 JPG |
| WebP → PNG | 800 × 600 WebP | Works | 800 × 600 PNG |
| Remove EXIF data | JPG with camera make, model, date and GPS tags | Works | JPG with no EXIF block |
| QR Code Generator | a URL | Works | 1024 × 1024 PNG |
| Color Palette | Generate | Works | CSS file |
| CSS Gradient | 45° gradient | Works | 1200 × 800 PNG |
How to check any online photo or file tool
This routine works on any converter, compressor or metadata remover, and on Design Bench after future updates. In a workshop, give everyone the same dummy photo and have them work through this list.
- Start clean. Use a private window or a profile with no extensions. Extensions send their own requests, and those show up as noise.
- Use a recognisable test image. Give it an odd name and size, such as
canary-test-7Q2.jpgat 2.4 MB, so an upload of that size stands out. - Watch from the first click. Some services upload as soon as you drop the file in, before you press any button.
- Look for
POST,PUTand WebSocket traffic whose sent size is close to your image's size. Also look for large requests to storage hosts: names containingstorage,upload,s3orblob.coreare common. - Keep two lists. Uploads move your file. Third-party loads, such as fonts, analytics and ads, tell another company you visited. Both matter, but in different ways.
- Run the offline test. If the tool works offline, the processing was local. If it fails, check the Network panel: it may have needed to fetch code, or it may need a server.
- For metadata removers, check the output too. Open the cleaned file in a metadata viewer you trust. Design Bench's own result screen shows what it checked, but verifying it with a second tool is good practice.
- Write down what you saw: the browser, the date and the result. A test only applies to the version of the site you tested, so repeat it before you use the tool with something sensitive.
Our test results, tool by tool
We tested the published version of each tool with Google Chrome 155 in headless mode, driven through the Chrome DevTools Protocol, which feeds the Network panel. We used synthetic images: an 800 × 600 test card as JPG, PNG, WebP and HEIC, and a JPG with fake camera and GPS tags. We ran each tool, downloaded each result and recorded every request. The test web server also logged the size of every request body it received.
| Tool | Network requests while processing | Requests with a body | Result |
|---|---|---|---|
| Image Resizer | 0 (2 local blob: previews) | 0 | 400 × 300 WebP |
| Image Compressor | 0 (2 local blob: previews) | 0 | WebP, about 5 KB |
| HEIC → JPG | 0 (1 local blob: preview) | 0 | 800 × 600 JPG |
| WebP → PNG | 0 (2 local blob: reads) | 0 | 800 × 600 PNG |
| Remove EXIF data | 0 (2 local blob: previews) | 0 | Camera and GPS tags gone |
| QR Code Generator | 0 | 0 | PNG |
| Color Palette | 0 | 0 | CSS file |
| CSS Gradient | 0 | 0 | PNG |
Totals across all 24 runs (online, offline straight after loading, and offline after one online run): 0 requests with a body and 0 POST/PUT requests. The only hosts contacted were pixdesk.cc and, at that time, fonts.googleapis.com and fonts.gstatic.com, all while the page was loading. After we switched to system fonts we re-checked page loads on 19 October 2026: the home page and all 8 tool pages contacted only pixdesk.cc. Every request our test server received during the tool runs was a GET, with 0 bytes of request body. Nothing went to Google Analytics or Supabase.
Sources
- Chrome for Developers: Open Chrome DevTools; Network features reference.
- Firefox Source Docs: Network Monitor; Toolbar; Request details; Throttling.
- Apple: Enabling Developer Features. WebKit: Enabling Web Inspector; Network Tab.
- Library used by the HEIC converter: heic2any.
You're welcome to link to or quote this guide. Sections 3 and 5 apply to any website. See also our EXIF remover, the privacy notice and about Design Bench.