Check for yourself that nothing is uploaded

Every toolcrate tool that opens your files or handles passwords says “never leaves this device”. You don’t have to take our word for it. Here are three ways to check, from the quickest to the most thorough.

1. Use it in airplane mode

Open the tool, then turn on airplane mode (or switch off Wi-Fi and mobile data) and use it as normal: merge the PDFs, compress the photo, generate the password. If it works with no connection at all, it can’t have sent anything anywhere. Open the tool once while you’re online first, or save the tools for offline, so your device has it.

2. Watch the counter on the tool

Those tools show a line under the title: Sent to other websites from this page: 0. It counts every request the page has made to any website other than toolcrate.cc since it opened, using your browser’s own record of the page’s network activity, and it updates as you use the tool. These pages have no ads, trackers or other outside scripts, so it stays at zero, unless you press a button that says it contacts another site (the password strength checker’s optional leak check is the only one), and then you’ll see it count.

Your browser won’t let them send anything

On these tools, toolcrate also tells your browser, with a standard security setting called a Content Security Policy, that the page may only talk to toolcrate.cc. Your browser then refuses any attempt to send data anywhere else (fetching, loading a picture, a font or a script, opening a frame, submitting a form), even if a bug or a booby-trapped file tried to. You can see the rule: in the developer tools (below), click the page itself in the Network list and find content-security-policy in its response headers. connect-src 'self' means “only toolcrate.cc”. The password strength checker’s rule names one more address, Have I Been Pwned’s, for its optional leak check.

3. Watch the network yourself

On a computer, every request a page makes is listed in your browser’s developer tools, so you can see exactly what goes where.

Open a tool, for example the PDF merger.
Open the developer tools: press F12, or Ctrl+Shift+I (Cmd+Option+I on a Mac). In Safari, turn on the Develop menu in Settings › Advanced first.
Choose the Network tab, tick Preserve log, and clear the list.
Now use the tool with your file. Watch what appears.

You’ll see the tool’s own program files arriving from toolcrate.cc the first time they’re needed (a PDF or image engine, for instance), and on toolcrate.cc itself one tiny anonymous page count (/api/hit, which holds just the page’s name and the site that linked to it). Click any request and look at its Payload: none of them carries your file or anything you typed.

What toolcrate does send

An anonymous count of the page you open (no cookies, nothing that identifies you), unless your browser sends Do Not Track or Global Privacy Control.
Your message, if you use the contact form.
A request for today’s exchange rates from the currency converter, and the name you look up in DNS lookup, to a public DNS service.
On other pages, Google’s ads, which in the UK and EU load only if you allow them.

The details are in the privacy policy.

How the tools work without uploading

Modern browsers can do the work themselves. The PDF tools use pdf-lib and Mozilla’s PDF.js, the image tools use the same compression engines as Google’s Squoosh (compiled to WebAssembly), and passwords come from your browser’s built-in cryptographic random number generator. All of it is downloaded to your browser like the page itself and runs there, which is also why the tools are fast: nothing waits for an upload.