What actually happens when you upload a file to an online tool
A step-by-step account of where your document goes on a typical file-conversion site, how long it stays, who can reach it, and how to check before you upload anything.
Updated 2026-08-03
Every free online converter follows the same eight steps, and only the first and last are visible to you. The six in the middle are where your contract, your medical scan or your passport photo actually lives for a while. None of this is sinister — it is simply how server-side processing works — but it is worth seeing written down, because the decision of whether it matters is yours and you cannot make it without the detail.
The eight steps
| # | What happens | Where your file is |
|---|---|---|
| 1 | You choose a file | Your device |
| 2 | The browser uploads it over HTTPS | In transit |
| 3 | A load balancer or CDN terminates TLS | Decrypted, on a machine you do not control |
| 4 | It is written to disk or object storage | Their storage, plus any replicas |
| 5 | A job queue picks it up | A worker, possibly a different machine |
| 6 | The result is written back | Storage again, now two copies |
| 7 | You download the result | In transit |
| 8 | A cleanup job deletes both, eventually | Storage, until the job runs |
What "we delete your files after an hour" covers
It is a real commitment and reputable services honor it. It is also, structurally, a promise about the future made by a party that already has the thing. That distinction is not pedantic — it is the whole difference between a policy and a property.
- It does not cover the window before deletion. An hour is an hour.
- It does not cover backups. Storage snapshots are taken on their own schedule and retained on their own.
- It does not cover a misconfigured bucket. Publicly readable storage is one of the most common breach causes there is.
- It does not cover legal process. A subpoena arriving inside the retention window reaches your file.
- It does not cover a change of ownership. Policies travel with companies; companies get sold.
The difference a client-side tool makes
A tool that processes in your browser never performs steps 2 through 6. There is no transit, no storage, no worker and no cleanup job, because there is no server — which means there is no retention window to shorten and no policy to trust. This is architecture rather than intention, and it is the only claim in this space that cannot be adopted by a competitor without rebuilding their product.
How to tell which kind you are using — in ten seconds
- Turn off your wifi and use it. A client-side tool keeps working. Nothing else does. This is conclusive and takes no expertise.
- Watch for a progress bar that says "Uploading". That is definitive in the other direction.
- Open the Network tab before you run the job. A POST with a request body the size of your file is your answer.
- Check how big a file it accepts. A hard 100MB cap is a server limit. A local tool is bounded by your own memory, not a plan tier.
When uploading is genuinely fine
Most of the time, for most files, nothing bad happens, and treating every conversion as a security incident is exhausting and unnecessary. A holiday photo, a public PDF, a draft nobody would care about — upload them without a second thought. The question is worth asking for a narrower set: signed contracts, medical records, identity documents, unpublished financials, anything under NDA, and anything containing somebody else's personal data rather than only your own. For those, "probably fine" is a strange standard to accept when an alternative exists that removes the question.
Questions
Is HTTPS not enough?
HTTPS protects your file in transit, which is steps 2 and 7. It does nothing for steps 3 through 6, where the file sits decrypted on somebody else's infrastructure. Encryption in transit and control of the data are different problems, and only one of them is solved by a padlock icon.
How can I check a specific site?
Disconnect from the network and try to use it. That single test separates the two architectures and requires no technical knowledge at all. For more detail, watch the Network tab in developer tools while you run a job.
Are paid tools safer than free ones?
Not architecturally. A paid service has a business model that does not depend on your data, which is a genuine difference in incentive — but the file still travels the same eight steps. What changes is who is motivated to look after it, not whether they hold it.
What about tools that say they are "zero knowledge"?
Check what the term is doing. Genuine client-side encryption before upload is a real and strong design. Used loosely as a synonym for "we do not look", it means nothing enforceable. If the server can process the file, the server can read the file.