hushvert

Proof, not promises

Every converter says your files are safe. We would rather you verify it than believe it. Here are three ways, strongest first.

1. Run it with the network off

The airplane-mode test

...

A converter that uploads your files cannot work offline. This one can, and you can prove it in ten seconds without trusting a word we say.

  1. Load the converter (the only step that touches the network).
  2. Turn on airplane mode, or just pull the plug.
  3. Convert. It works, because your file never needed to go anywhere.

2. Watch the network tab

Open your browser's developer tools, switch to the Network tab, then convert any image, archive, PDF or audio file on this site. You will see small page assets and the codec download, and nothing else: no request carries your file's bytes, because no request needs to. The conversion happens in WebAssembly, in your tab.

3. Read the test that holds us to it

Our CI runs a browser test on every build that drops a real file, converts it, and fails the build if any request body exceeds 2KB or touches a server-job API during a client conversion. This is the actual contract from the test suite:

// The privacy contract: after a file is selected, no request may carry file
// bytes. 2KB leaves room for analytics-sized payloads while catching any
// fixture upload (every fixture is larger than 2KB once encoded, and chunked
// uploads would still trip this on the first chunk).
export const MAX_REQUEST_BODY_BYTES = 2048

// Client-engine conversions are session-free. Any call to the session or
// server-job APIs during a client conversion is a violation, regardless of
// body size.
const SESSION_OR_JOB_API = /\/api\/(session|jobs|conversions)\b/

The conversion engine itself is open source under the MIT license, so you can audit exactly what runs in your browser: github.com/hushvert/engine.

The honest exception

A few conversions need software a browser cannot run (office document layout engines, big video encodes). Those upload to our server over an encrypted connection, are converted, and are deleted: the upload immediately after conversion, the output within about an hour. The dropzone tells you which engine a conversion uses before you start it, and the free limits are published, not hidden. Everything else never leaves your device at all.

Details live in the privacy policy; the free limits are on the pricing page.