You are about to drag your signature, your passport scan, or a signed contract into a free online resizer. The site looks clean, the button says "100% private," and you have no way to verify that claim before you click. That gap between "trust me" and actual proof is exactly what browser DevTools closes, and you can close it yourself in under two minutes without writing a single line of code.
Browser-based tools like signature resizers, PDF compressors, and image converters run inside your browser using JavaScript, the Canvas API, and the File API (dev.to). Some genuinely never touch a server: the Canvas API repaints pixels locally, and the File API reads your upload directly into memory. Others are server-side applications wearing a browser-tool costume, quietly sending your file to a remote machine for processing (dev.to). The only way to know which one you are dealing with is to watch the network traffic yourself.
Step 1: Open the Network Tab Before You Touch the File
Order matters here. Open DevTools first, then load the tool, then upload your file, so you capture every request from the start.
- In Chrome, Edge, or Firefox, press F12, or right-click anywhere on the page and select "Inspect."
- Click the "Network" tab in the panel that opens, usually docked at the bottom or side of your browser window.
- Turn on "Preserve log" (Chrome/Edge) or confirm logging isn't paused (Firefox). This keeps the request list from clearing if the page redirects or reloads.
- Refresh the tool's page once with the Network tab open, so you start with a clean, empty list.
- Now, and only now, select or drop in your file.
Watch the list populate in real time as you interact with the tool. Most local tools show almost nothing new after you pick the file — maybe a font or icon loading, but no large data transfer.
Step 2: Read What Just Happened in the Request List
After you select the file, look at the new entries in the Network panel. Each row shows a request name, a method (GET or POST), a size, and a status code.
A POST request is the one to watch. GET requests just fetch resources like scripts or images; POST requests send data somewhere, which is how a file upload actually travels to a server. If a POST request fires immediately after you select your file, and its size roughly matches your file's size on disk, that tool is uploading your document.
Click that request to expand it. In Chrome and Edge, check the "Payload" or "Request" tab; in Firefox, check "Request" or "Params." Binary data, a "multipart/form-data" content type, or your filename in the request body all confirm an upload. Then check the "Headers" tab for the request's destination domain — if it points somewhere other than the site you are visiting, your file may be heading to a third-party analytics or processing service.
Step 3: Compare Local Processing vs. Server-Side Behavior
Knowing what "clean" looks like matters as much as spotting the red flag. In a truly local tool, selecting a 2 MB signature image or PDF produces no large new POST request. The Network tab stays mostly quiet — maybe a handful of tiny GET requests for fonts or tracking pixels under 50 KB, none matching your file's size or type. For more on this, see related: how to build a shutdown ritual for remote developers.
All the visible work happens in the page itself. The image resizes instantly on screen, a progress bar fills without triggering a network call, and the download or "save" button produces a result with no upload request beforehand. This matches how the Canvas API and File API work: they read and rewrite pixel data entirely in browser memory (dev.to).
A server-side tool tells a different story. Within a second or two of selecting your file, you'll typically see a POST request fire, its size tracking closely with your file's size. A pause follows while a progress indicator spins, then a GET request or a second POST retrieves the processed result. That round trip — upload, remote processing, download — is the signature of a file leaving your device.
Quick-Reference Checklist
Use this comparison the next time you're unsure about a tool.
Signs a tool is local:
- No new POST request appears after file selection
- Network tab stays mostly idle aside from small asset loads
- Processing happens instantly, with no spinner tied to a network call
- The result downloads without a prior upload request
- Request sizes never match your file size
Signs a tool is server-side:
- A POST request appears immediately after you select the file
- The POST request's size roughly matches your file size
- A loading or "processing" delay correlates with visible network activity
- Request headers show a domain different from the site you're visiting
- The response includes a URL or file ID pointing to server-stored data
Step 4: What to Do If the Tool Uploads Your File (or You Can't Tell)
If you spot that suspicious POST request, do not proceed with a sensitive document — even if the site claims to delete files after processing. You have no way to verify deletion, and the file already left your device the moment that request completed.
Also read: our guide to does firefox's jpeg fix replace responsive images?
If the traffic is ambiguous — for example, the tool uses HTTPS with encrypted payloads that DevTools cannot read in plain text — treat it as server-side by default. Encrypted does not mean local. It just means you cannot see the contents; the request pattern itself (POST, matching size, timing right after file selection) still tells you data moved off your device.
For genuinely sensitive files — signatures, IDs, signed contracts — a few safer options:
- Use your operating system's built-in image editor instead of a browser tool: Preview on macOS, or Paint or Photos on Windows, to resize a signature image without any upload at all.
- Reuse a browser tool you have already verified as local, once you've run this DevTools check and confirmed the behavior.
- Check the site's privacy policy for an explicit claim of in-browser processing, then verify it yourself with the Network tab. Stated intent plus verified behavior is about as much assurance as a free tool can offer.
Running this check takes less time than filling out the form you were about to upload your signature for, and it turns a vague privacy claim into something you confirmed yourself. Next time a new PDF compressor or image converter shows up in your search results, open DevTools first and let the Network tab do the talking before your file does.
