How Greatest File Tools processes your files

Short answer

Every tool on this site runs in your browser tab. When you add a file, the tool reads it into the tab's memory, processes it with code downloaded from greatestfiletools.com, and hands the result back to you as a download. Your files, their names and the results aren't sent to our servers or to anyone else.

The rest of this page shows what each tool uses, what our servers and analytics can see, and how we check it. Our privacy policy covers everything else the site collects.

Tool by tool

Library versions are read from the build that produced this page. “When first needed” means the library downloads the first time you use the feature that needs it, not when the page opens.

Browser features the tools use

These are built into your browser. The list is generated from the tools' source code.

What our servers see

The site is a set of static files hosted on Vercel. Your browser requests pages, scripts, styles, fonts and the tools' libraries. Like any web host, Vercel receives standard request data with each of those requests: your IP address, browser type (user agent), the address requested and the time. While a tool processes a file, the only requests it makes are for its own code, such as a library it needs for the first time. Those requests don't include anything from your files.

What analytics sees

If you accept analytics cookies, Google Analytics records your visit. It doesn't receive your files or file names.

Until you click Accept, the Google Analytics script isn't requested at all. After you accept, it loads from googletagmanager.com and sends page-view and engagement events to Google. On September 29, 2026 we observed these fields in those requests: the page address and title, a random ID stored in the _ga cookie, a session ID and session count, whether the session was engaged, your screen size and browser language, browser and device details your browser reports (brand, version, platform and device model), the event name, and technical settings of the tag. Google also receives your IP address with each request.

Our tool code doesn't call Google Analytics or put a file name in the page address or title. Downloads use temporary blob: addresses, which contain a random ID rather than the file name.

Change your choice at any time under Cookie settings.

The /api address

Earlier versions of this site forwarded addresses under /api/ to a separate file-processing service. None of the tools used it. That forwarding has been removed, so this website has no upload service.

How we check it

Each tool has an automated test (the ID in the table above, such as net:merge-pdf). The test opens the tool in a real browser, gives it sample files whose content and names contain a random marker, runs the tool's main steps (every path that loads a different library, including ZIP downloads), downloads the result and closes the page. While it does, it records:

• every request to the site, from the page and from its background workers;
• every attempt by the page or its background workers to connect to another site (the test blocks them);
• the requests the browser reports, and the calls the page's own code makes to send data.

It then checks that:

• nothing went to any other site;
• requests to this site only fetched its files: none sent data to it;
• no request address, header or body contains the marker or a file name, written out plainly or encoded;
• the page opened no WebSocket, server-sent event stream or peer-to-peer connection;
• at the end, the cookie jar is empty and browser storage holds nothing but your cookie choice.

It runs in Chromium (the engine of Chrome and Edge), Firefox and WebKit (the engine Safari is built on). The table above shows the date of a run that passed for each tool, and in which engines. Last run: October 17, 2026.

What the test can't prove

• It covers the flows and synthetic files it runs, not every option or every file.
• It looks for the marker and the file names. It can't detect data that was transformed first, such as a thumbnail of your image.
• It runs desktop browsers on a computer. Playwright's WebKit is close to Safari but isn't Safari on an iPhone, and the test doesn't run on phones.
• It runs with analytics declined. One more test accepts analytics and checks that the page then contacts only Google Analytics' addresses, and that none of its requests contains the marker or the file name. In that test Google's script is replaced by an empty stand-in, so what Google's own code sends isn't tested. With analytics accepted, Google receives the fields listed above.

Check it yourself

1. Chrome or Edge: open the tool, press F12 (Cmd+Option+I on a Mac) and choose the Network tab. Tick “Preserve log”, then process a file.
2. Firefox: press Ctrl+Shift+E (Cmd+Option+E on a Mac) to open the Network tab. In its settings menu, turn on “Persist Logs”, then process a file.
3. Safari: turn on “Show features for web developers” in Safari's Advanced settings. Then choose Develop > Show Web Inspector, open the Network tab and process a file.

Every request you see should go to greatestfiletools.com, or to Google's analytics hosts if you accepted analytics. Entries starting with blob: or data: stay inside your browser tab.

Open-source code we use

These libraries, and the packages they include, are served from greatestfiletools.com with the tools. Each stays under its own license. Versions are the ones installed for this build.

Changes to this page

• October 17, 2026: The file test now runs in Chromium, Firefox and WebKit. It also watches requests from background workers and connection attempts to other sites, and checks that requests to this site only fetch its files. The site's Content Security Policy is now enforced, not only reported.
• September 29, 2026: Page published. Tool code, the PDF.js worker and the fonts are now served from greatestfiletools.com instead of unpkg.com, jsDelivr and Google Fonts, and Google Analytics waits for your consent.

Questions or a problem with a tool? Email privacy@greatestfiletools.com.