Processed on this device
LocalFileLab
Back to the toolsSecurity

A transparent security model for local files.

LocalFileLab removes the most important data transfer: files selected for conversion, compression, inspection and dedicated studios are not uploaded to a LocalFileLab processing server. This page explains the actual data flow, remaining network requests and browser-sandbox limits.

How your data flows

  • Only files you explicitly select, drop or open through a project file become readable by the active tool.
  • JavaScript, WebAssembly, Canvas, Web Audio, WebCodecs and browser codecs process content in the current tab.
  • Previews and outputs are exposed as in-memory objects or temporary object URLs in the browser.
  • Removing a file, reloading or closing the tab discards those temporary references; only files you intentionally download remain.

LocalFileLab has no file upload endpoint for file processing. Ads and external runtime components do not automatically receive access to selected files.

Browser sandbox and memory

Processing stays inside the browser security boundary. LocalFileLab can only read files you explicitly select or drop. Results remain in memory or temporary browser resources until downloaded or removed.

Very large, encrypted, damaged or specially crafted files can consume substantial memory and processing time or exceed library limits. Use an up-to-date browser and keep enough memory available. A successful import does not prove a file is safe.

External runtime resources

Some media operations load FFmpeg/WebAssembly components from jsDelivr. OCR may download worker and language data used by Tesseract. These requests expose normal connection data, but not the contents of your selected files.

Google AdSense is embedded as a separate advertising system. It has no programmatic access to selected file contents, but may process its own technical data. See Privacy for details.

Metadata and output files

Depending on the format, you can preserve or remove compatible metadata. Metadata may contain names, timestamps, device details, location data or embedded artwork. Review sensitive outputs before sharing.

Use LocalFileLab safely

  • Process confidential files only on a trusted and updated device.
  • Download the output and then remove it from the list.
  • Continue to treat unknown archives and documents cautiously.
  • On shared devices, use a private browser profile and close the tab afterwards.

Report a vulnerability

Do not include sensitive file contents in a public issue. Security concerns can be reported through the repository security area.

GitHub Security