Security and file handling
Toolkeel tools process files inside your browser and never upload them. How it works, how to verify it yourself, and how to report a security issue.
How the tools work
When you open a tool page, your browser downloads the page and its JavaScript code from our server, the same as any website. When you add a file, the code reads it from your device into the browser's memory, processes it there, and gives you the result as a new file to save. There is no upload step and no server code that could receive your file.
- Images are decoded and re-encoded with your browser's built-in image engine; HEIC photos with the open-source libheif decoder, downloaded from our server the first time you use it.
- PDFs are edited with pdf-lib and drawn with Mozilla's pdf.js, both running in your browser.
- Text, data, passwords and calculations never leave the page you typed them into.
Check it yourself
- Watch the counter. Every tool shows "Network requests since you started". If a tool needs to download its own program code (for example the PDF engine) the counter shows it, and its details list the file, which is always a download from our site, never your data.
- Use your browser's developer tools. Press F12 (or Cmd+Option+I on a Mac), open the Network tab, then use a tool. No request carries your file.
- Go offline. Load a tool page, use it once so its code is loaded, turn off Wi-Fi, and use it again. It keeps working.
Protections built into the site
- HTTPS only, with HTTP Strict Transport Security.
- A strict Content Security Policy: pages may only load code from Toolkeel itself and the named analytics/advertising providers, and may not send data to other servers.
- Files are checked by their actual content, not just their name. Very large images are refused before decoding to protect your device's memory, and regular-expression tests run in an isolated worker with a time limit.
- No accounts, passwords or payment details are collected, so there are none to leak.
- Third-party libraries are hosted on our own server, not loaded from other sites.
Limits of these protections
Processing on your device protects your files from us and from servers on the internet. It cannot protect against malware already on your computer or browser extensions that can read web pages. For very sensitive documents, use a trusted, up-to-date device.
Report a vulnerability
Email support@toolkeel.com with "Security" in the subject and steps to reproduce. Please allow reasonable time for a fix before public disclosure. See also our security.txt.