Most online image tools upload your files. A few don't. Here's the architectural difference and which tools actually keep files on your device.
Most online image tools work the same way: you upload a file, their server processes it, you download the result. For a lot of casual use cases — stock photos, generic graphics — this is fine. For others — client work, personal photos, anything with metadata you'd rather not share — it isn't. Here's how the major image tools handle privacy in practice, and what to look for.
Short version: only two well-known image tools actually process files in your browser — Google's Squoosh and pictoolkit. Everything else uploads. If privacy is a hard requirement for your workflow, your options narrow quickly.
The standard architecture for online image tools:
This is how TinyPNG, iLoveIMG, Compressor.io, Convertio, CloudConvert, and most others work. The image is in their possession during step 3, and remains on their servers for some retention period.
Since 2018, browsers have been capable enough to handle image processing locally using WebAssembly and the Canvas API. This architecture:
At no point does the file leave your device. There's no server retention policy because there's no server retention. You can verify this yourself by opening your browser's developer tools (DevTools → Network tab) and watching network traffic while you use the tool — you'll see no image upload.
| Tool | Architecture | File retention (claimed) |
|---|---|---|
| TinyPNG | Server upload | Up to 48 hours |
| iLoveIMG | Server upload | ~2 hours |
| Compressor.io | Server upload | Varies |
| CloudConvert | Server upload | 24 hours |
| Squoosh (Google) | Browser (WebAssembly) | No upload — n/a |
| pictoolkit | Browser (Canvas + WebAssembly) | No upload — n/a |
To be fair, the server model isn't inherently bad. For many use cases, it works well:
The server architecture exists for legitimate reasons. The question is whether your specific use case falls into one of these "fine" categories.
Three categories where you should be cautious about upload-based tools:
For these, "the company deletes files after 2 hours" isn't sufficient — once the file has been uploaded, you've lost technical control over it. You're trusting the company's policy and operational security.
If you've decided you want browser-based tools, you have two main options. Both run entirely in your browser; the choice depends on what you need to do.
Squoosh (by Google Chrome Labs) uses purpose-built WebAssembly codecs (MozJPEG, OxiPNG, jpegli) that can produce slightly smaller files than the standard Canvas API approach at extreme quality settings. It's the gold standard for compression quality. The limitations: it only handles one image at a time (no batch mode — this has been the most-requested feature on its GitHub for years, unimplemented), and it focuses on compression and conversion only.
pictoolkit uses the Canvas API plus WebAssembly libraries where appropriate. Compression quality is comparable to Squoosh's for typical web use, though Squoosh wins on extreme edge cases. The advantages: full batch processing (hundreds of files at once), and 20+ tools beyond compression — resize, crop, watermark, HEIC conversion, EXIF stripping, photo filters, color picker, favicon generator, GIF maker, meme generator, collage maker, and more.
For a single image with maximum compression control, use Squoosh. For batch work or any operation beyond compression, use pictoolkit.
If a tool claims to process files locally, you can verify it in 30 seconds:
If you see an XHR or fetch request with your file as the payload, the tool is uploading despite any claims to the contrary. This is the only way to be sure.
Most online image tools were built before browser-side image processing was practical, and they still use the server architecture they were designed with. That's not a moral failing on their part — it's a historical accident. But it does mean that if privacy matters for your workflow, you have fewer options than you might think.
Squoosh covers the "compress one image perfectly" case. pictoolkit covers everything else — batch work, multi-step workflows, twenty different tool types. Between them, most legitimate image-processing workflows can be handled without ever uploading a file.
If you want to try the privacy-first approach, open any pictoolkit tool and verify it yourself using DevTools.
Architectural and retention information sourced from each provider's public documentation, verified May 2026. Trademarks belong to their respective owners; pictoolkit is independent and unaffiliated with any of the named tools.