Prove it
Every tool site says your files are safe. Here is the difference between saying it and showing it.
DuckyTools has no upload endpoint. Not a policy — an absence. The site is static files plus JavaScript, so there is no server to receive a file, no bucket to store one and no queue to process one. Below, a real tool runs while the browser's own performance timeline counts every request it makes.
- Requests during processing
- Zero
- Analytics
- None, on any page
- Cookies
- None
- Third-party scripts
- None
- Works offline
- Yes, once a page has loaded
Watch it happen
Type below. The counter uses PerformanceObserver — the browser reporting on itself, not us reporting on ourselves.
Check it yourself — three ways
Do not take the counter above on trust either. It is our JavaScript. These are not.
1. Turn off your network
Load any tool page, disconnect from wifi, then use it. It keeps working. A tool that processes your file on a server cannot do that, and no amount of clever code gets around it.
2. Watch the Network tab
Open developer tools, go to Network, clear it, then run a tool on a large file. You will see nothing appear. A site that uploads shows a POST with a request body the size of your file — that is what you are looking for, and it is unmistakable.
3. Read the source
The whole site is on GitHub, and the build that produces it is in the same repository. There is no server component to hide anything in, because there is no server component.
The one exception, stated plainly
Optical character recognition in a language other than English downloads that language's training data from a public CDN the first time you pick it. Your image is not part of that request — only the language name is — but it is a request to a third party, and we would rather name it than let you find it. English OCR is self-hosted and makes no external request at all, as is the AI background remover's 62MB model.
Why this is architectural, not a promise
Every competitor could adopt our privacy policy tomorrow. None of them could adopt our architecture without rebuilding their product, because their processing lives on a server and ours does not exist. A deletion policy is a commitment about the future made by someone who already has your file. This is a statement about the present: they never got it.