Toolium

What "client-side only" actually means, in 2026

Hemanth Gedda9 min read

Open a free online tool site at random. Scroll to the bottom of the homepage. There is roughly a 90% chance you will see one of these phrases somewhere on the page:

  • "All processing happens in your browser."
  • "Your files never leave your device."
  • "100% client-side processing."
  • "No upload, no server, no compromise."

Almost half of these claims are flat-out wrong. Most of the other half are technically true and operationally misleading. This post is about the actual semantics of "client-side only" in 2026 and how to verify a site's claim against its behavior in less than a minute.

The spectrum

"Client-side only" is not a binary property. It is a spectrum with at least four distinguishable levels.

Level 0: server-side, but the marketing says otherwise. Your file gets uploaded over HTTPS, processed on a server, returned as a download. The "client-side" claim in the marketing copy refers to the user interface being a React app, which is technically true and operationally useless from a privacy standpoint. Most of the consumer-grade free tool sites are at this level despite their copy suggesting otherwise.

Level 1: client-side compute, server-side telemetry on the file. The file is processed in your browser. The site also sends file metadata (filename, size, type, timestamps, sometimes a hash) to its analytics provider. The contents stay private, but a record of what you processed and when does not. The site can correlate this metadata with your IP, user agent, and account if you have one.

Level 2: client-side compute, anonymized usage telemetry. The file is processed in your browser. The site sends anonymous metrics about feature usage (e.g., "PDF merge action happened, file size bucket: 1-10MB") without tying the metadata to your identity. The aggregate data shows the site operator what tools are popular; the per-user data does not.

Level 3: client-side compute, no telemetry whatsoever. The file is processed in your browser. No analytics. No ads. No third-party scripts that report back. Almost no commercial site operates at this level because operating a website costs money, and the funding usually requires some form of telemetry or ads.

Toolium operates at Level 2. The file content never leaves the page. Vercel Analytics runs cookielessly for traffic metrics. Google Analytics and AdSense load only after explicit consent. The Privacy Policy explicitly enumerates these. No commercial free tool site I am aware of operates at Level 3.

The thirty-second test

Anyone can verify which level a tool actually operates at in less than a minute. The recipe:

  1. Open Chrome DevTools (right-click, Inspect, or Cmd-Option-I on Mac).
  2. Switch to the Network tab.
  3. Click the clear icon to reset the request log.
  4. Drag your file onto the tool's upload area.
  5. Click whatever action button the tool exposes (Merge, Convert, Compress).
  6. Wait for the output to appear or download.
  7. Scan the network log for any request whose payload size matches your input file's size.

What you should see at Level 1 through 3:

  • Analytics beacons (Google Analytics, Plausible, Mixpanel). Small, frequent, no file payload.
  • Ad-related requests (AdSense, ad exchanges) if the site shows ads. Small to medium, no file payload.
  • Maybe a request to fetch an asset (a JavaScript library, a font).

What you should not see at any level above 0:

  • A large POST request to the site's own domain. If your 5MB PDF produces a 5MB request, the file is being uploaded.
  • A POST request to a suspicious third-party (file.io, uploadthing.com, etc.) with a body size matching your input.
  • An encrypted upload to a CDN like Cloudflare R2 or AWS S3 (these have characteristic URL patterns).

This test catches Level 0 sites immediately. A 5MB PDF will produce a 5MB POST body if it is being uploaded. There is no way to hide that from the network tab.

A deeper analysis if you care

For a true verification, you can read the source. Open the page, switch DevTools to the Sources tab, find the JavaScript that handles the file upload, and search for fetch(, XMLHttpRequest, navigator.sendBeacon, or WebSocket calls inside the upload handler. If there is no network call inside that handler, the processing is local.

Almost no users do this. Most users trust the marketing copy and never check. The result is a category of "free online tools" that operate as Level 0 services with Level 3 marketing.

The phrase versus the reality

The phrase "client-side only" should mean Level 3 unless explicitly qualified. The fact that it is used to describe Level 0 sites is a marketing failure that is mostly invisible to users.

What I would push for as a baseline:

  1. Sites that claim "client-side" should publicly explain what telemetry they collect. The Privacy Policy is the right place. "We do not collect file contents" is necessary but not sufficient; the policy should also say what metadata flows.
  2. Sites should make verification easy. "Open dev tools, you will see no upload" is a reasonable invitation. Toolium does not yet do this on the tool pages; I am planning to add a small "verify this claim" note that explains the network-tab test.
  3. Privacy policies should distinguish between file content and file metadata. Most do not.

The honest case for Level 2

I want to be careful not to overclaim. Toolium runs analytics. Toolium serves ads (will resume serving once AdSense approves). Toolium uses Microsoft Clarity (behind consent) for session-replay UX research. Each of those is a third-party script that reports to its provider. None of them see file content; all of them see metadata about the visit.

If your threat model requires zero telemetry, every commercial website fails it, including Toolium. The mitigation Toolium offers is: the tools work offline once the page has loaded. Disconnect from the network after the page renders, the tools keep working, no further requests fire. That is the closest you can get to Level 3 on a commercial site that needs to fund its hosting somehow.

For most users, Level 2 is the right balance: the file is private, the metadata is shared with disclosed providers, and the funding model does not require selling the file content. The improvement over Level 0 is enormous; the gap to Level 3 is small and probably not worth giving up the funding.

What to demand of any tool you trust with a file

The next time a tool claims "your files never leave your device," do not take it at face value. The phrase has been so overused that it is meaningless without verification. The thirty-second test catches the worst offenders. The Privacy Policy catches the rest. If neither yields a clear answer, assume the worst and use a different tool.

The default should be skepticism. Verify, then trust.