How to check a website isn’t uploading your files

Step 1: open the Network tab

Every desktop browser has developer tools with a Network panel that lists each request the page sends and receives. Open it before you choose a file.

Chrome and Edge

1. Press F12 or Ctrl+Shift+I (on a Mac, Cmd+Option+I).
2. Click the Network tab.
3. Tick Preserve log, so requests aren’t cleared if the page reloads.

Firefox

1. Press Ctrl+Shift+E (on a Mac, Cmd+Option+E) to open the Network panel directly.
2. In the panel’s settings (the gear icon), turn on Persist Logs.

Safari

1. Go to Safari, Settings, Advanced and turn on the option to show features for web developers (older versions call it “Show Develop menu in menu bar”).
2. Press Cmd+Option+I or choose Develop, Show Web Inspector, then click Network.

Phones don’t have these tools built in, so do the check on a computer.

Step 2: use the tool and watch

1. Clear the list (the circle-with-a-line icon) so you start fresh.
2. Choose a file, ideally a harmless test file, and run the tool: compress, convert, whatever it does.
3. Watch the new rows appear, and keep the panel open while you download the result.

Step 3: what an upload looks like

Most rows are downloads to you: the page’s scripts, styles, fonts and images. They use the GET method and are harmless. An upload looks different:

• The method is POST or PUT. Add the Method column by right-clicking a column header if it isn’t shown.
• It goes to an API address, often with words like upload, convert or api in it, sometimes on a different domain.
• The request carries your file. Click the row and look at Payload (Chrome and Edge) or Request (Firefox). You may see your file name, or form data the size of your file.

Use the Fetch/XHR filter to hide static files, and check the WS filter too: files can also be sent over a WebSocket connection, which appears as a single row whose messages you inspect inside it.

A clean result is a list with no requests at all after you pick the file, or only downloads of the tool’s own code.

Content Security Policy, explained simply

The Network tab shows what a page did. A Content Security Policy (CSP) shows what it is allowed to do. It is a set of rules the website sends with the page, and your browser enforces them. If a script tries to break them, the browser blocks the request and reports an error in the Console.

The rules that matter for uploads:

• connect-src lists where scripts may send data (fetch, XHR, WebSocket). 'none' means nowhere. 'self' means only the site’s own server.
• form-action lists where forms may be submitted.
• default-src is the fallback for anything not listed separately.

How to read a site’s CSP

1. In the Network tab, reload the page and click the first row, the page itself.
2. Open Headers and scroll to the Response Headers.
3. Find content-security-policy. No header? Check the page source for a <meta http-equiv="Content-Security-Policy"> tag. If there is neither, the page may connect anywhere.

Here is part of the policy on InTheTab’s homepage and most of its tool pages:

default-src 'none'; connect-src https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com; form-action 'none'

That tells your browser to refuse every form submission, and every connection except to Google Analytics, which InTheTab uses to count visits. A policy can’t show what a page sends, only where, which is why the Network tab check above matters too.

Honest exceptions on InTheTab

A CSP limits where a page can connect, not what it sends, so it is worth knowing where InTheTab allows connections and why:

• Visit counts. Every page may connect to Google Analytics, which records page visits and which tool was used. InTheTab never sends it your files, file names or what you type into a tool, and in the Network tab those requests are small and contain no file data. Visitors in Europe are asked first; see the privacy policy.
• PDF tools also use connect-src 'self', so the PDF engine can load its own worker, WebAssembly and font files from InTheTab. InTheTab is a static site with nothing that receives uploads, and the Network tab shows only GET requests for those files.
• The background remover is the one tool that downloads from other sites. On first use it fetches its open-source AI model (about 100 MB) from Hugging Face and the ONNX runtime from jsDelivr, so its CSP allows those addresses. In the Network tab you’ll see large GET downloads coming in. That is a download to you, not an upload of your photo; later uses load the model from your browser’s cache.