How in-browser image conversion actually works (and why I built it that way)

The reason this whole site exists is a small, dumb moment of unease I had years ago. I needed to convert one HEIC photo to JPG, I typed the obvious thing into a search bar, and I landed on a converter that wanted me to upload my picture to their server. So I did. It worked. And then I sat there thinking: that photo is now sitting on some machine I know nothing about, run by people I'll never meet, kept for a length of time I was never told. For a random screenshot, fine. But it wasn't a screenshot. It was a personal photo, and I'd just handed it to strangers to save myself thirty seconds.

That's the problem I set out to not have anymore. The answer turned out to be that the upload was never necessary in the first place.

The old way: rent a stranger's computer

A traditional online converter works like a mail-order service. You send your file up to a server. The server runs the conversion using software installed on its machine. It sends the result back down. Your image made a round trip through hardware you don't control, and somewhere in the middle it sat, in full, on a disk that isn't yours.

Every privacy promise bolted onto that model is a promise about behavior — the file gets deleted after an hour, nobody looks. Maybe that holds. Maybe it does. You have no way to check, and you're trusting it with the actual bytes of your file. The trust is the whole architecture, and trust is exactly the thing I didn't want to be spending.

The new way: your browser already has the computer

Here's what changed. Modern browsers can run real, compiled programs at near-native speed, through something called WebAssembly — WASM for short. The image codecs that used to live on a server — the code that reads a PNG, that encodes a WebP, that decodes HEIC — can be compiled to WASM and run inside the browser tab you already have open.

So when you drop a file onto a page built this way, the conversion software downloads to your machine, once, like any other part of the web page. From then on the actual work — reading your image, transcoding it, writing the new file — happens on your own processor, in your own memory. The result is handed straight back to you as a download. Your file is never sent anywhere, because there's nothing to send it to. There's no server in the loop at all.

That's why I can say your files never leave your device and mean it as a fact rather than a policy. It isn't that I promise not to look. It's that there's no path by which your image reaches me. I couldn't retrieve your photo if a court ordered me to, because it was never on my side of the wire. The privacy isn't a feature I added on top. It's a consequence of where the code runs.

How you can tell it's true

You don't have to take my word for it, and that's the part I like most. Open your browser's developer tools, watch the network tab, and convert a file. You'll see the page and the WASM codec download once. You will not see your image go up. Better still: load the page, turn off your Wi-Fi, and convert something anyway. It still works, because everything it needs is already on your machine. A tool that uploads your files cannot do that. This one can.

The one real limitation

I promised honesty, so here it is. Running the conversion on your own device means it uses your own memory, and a browser tab doesn't get infinite memory to play with.

For normal files — photos, screenshots, logos, the stuff people convert all day — this is a non-issue. But if you throw something genuinely enormous at it, a single image at extreme resolution, or a huge batch all at once, you can hit the ceiling. Decoding an image means holding its uncompressed pixels in memory, which is far larger than the file on disk, and a giant image can exhaust what the tab is allowed. When that happens the conversion slows to a crawl or the tab gives up.

A server with 64 GB of RAM never has that problem. So there's the trade, stated plainly: a server-side converter can chew through files bigger than your device could ever handle. This approach can't. What it gives you in exchange is that your file never leaves your hands. For the overwhelming majority of what people actually convert, that's a trade worth making without a second thought. For a rare monster file, it's a real limit, and I'd rather tell you than pretend it away.

Why I still think it's the right default

Most conversions are ordinary files that never needed to touch a server to begin with. The upload was always a leftover from an era when browsers couldn't do this work themselves. They can now. So the sane default flipped: keep the file on your machine, do the work locally, and only reach for a server on the rare occasion your own hardware genuinely can't cope.

That's the whole idea behind everything here. It's the same site I built for myself after that one uneasy afternoon, so I'd never again have to hand a personal photo to a stranger just to change its file extension. Turns out I never had to. Neither do you.