Online file security: good habits worth keeping

A payslip to compress before emailing it to the bank, a photo of a driving licence to resize for a tenancy application, a contract to merge with its annexes. The instinct is always the same: type “compress PDF” into a search engine and drop the file on the first site in the list. That is precisely the moment of greatest risk, because nothing on the screen tells you what happens to the document after the click.

There is no single rule along the lines of “the web is dangerous, installed software is safe”. There are concrete questions worth asking, and checks that take thirty seconds.

The only question that really matters: does the file leave your device?

Two very different architectures sit behind the same “drop your file here” interface.

• Processing in the browser. The file is read by JavaScript or WebAssembly running on your own machine. Nothing is sent over the network: the document never leaves the tab’s memory. That covers text manipulation, calculators, hashing and a great many image operations.
• Processing on a server. The file is uploaded, handled by libraries installed remotely, then sent back. Unavoidable for video, for rendering PDF pages and for HEIC conversion. The server sees the contents in the clear.

On Convertu, 41 of the 60 tools run entirely in the browser; the other 19 — PDF, video, background removal, HEIC, HTML validator — go through the server. That information should be available before you upload, not buried in the terms and conditions.

How to check for yourself

Open your browser’s developer tools (F12 on Windows, Cmd+Option+I on macOS), go to the Network tab, clear the list, then start the conversion. If no request leaves carrying your file’s worth of data — a 4 MB POST request for a 4 MB file stands out at a glance — the processing really is local. There is an even simpler version of the test: turn the Wi-Fi off just before you click. A genuinely local tool finishes the job; a server tool throws an error.

Your files say more than their contents

What you can see is only part of what you hand over. The invisible layers are often far more talkative.

• JPEG and HEIC photos. EXIF metadata holds the exact date and time, the camera model, the shooting settings and the GPS coordinates of the spot where the picture was taken, accurate to within a few metres. A photo of an item for sale, published just as it came off the phone, gives away the seller’s address.
• PDFs. The document information dictionary keeps the author, the producing software and the creation and modification dates. A PDF exported from a word processor sometimes carries the full path of the source file, machine username included.
• Word documents. Author, last person to save it, total editing time, and above all comments and tracked changes that were never accepted. A contract sent out with its internal comments intact is still a classic.

For an image, the simplest fix is to re-encode it: resizing or recompressing rebuilds the file from the decoded pixels, without copying the original EXIF blocks across. Running it through image compression cuts the file size and tidies things up along the way. Check the result anyway by opening the file properties before you send it anywhere. For a PDF or an office document, review the properties in the software that created it before exporting: that is where the cleanup is reliable.

Encrypting a document before you share it

The PDF format distinguishes between two passwords, and confusing the two is costly.

• The open password (the “user” password) genuinely encrypts the contents. Without it, the file is unreadable.
• The permissions password (the “owner” password) merely sets flags saying “printing not allowed”, “copying not allowed”. The document is not protected: most viewers honour those flags out of politeness, others ignore them.

If the point is for an intercepted attachment to be useless to whoever ends up with it, an open password is what you need. Convertu lets you add a password to a PDF; like every PDF tool in the catalogue, it runs server-side, so the file is handled there in the clear and then deleted after an hour. For a document whose contents must be seen by nobody else, not even in passing, prefer encryption carried out locally.

Two further rules round out the setup. First, the password has to withstand an offline attack: anyone holding the file can try billions of combinations with no limit on attempts. A long passphrase, or a random string of at least sixteen characters from a password generator, will hold up; “Smith2024!” will not. Second, never send the password in the same message as the attachment: one compromised mailbox hands over both at once. A text message is enough to separate the channels.

Checking that a file is the one you were expecting

A fingerprint, or hash, turns any input into a short string of fixed length: change a single byte and the string changes completely. Use the SHA hash tool for a snippet of text or a string you want to compare: it shows SHA-1, SHA-256, SHA-384 and SHA-512 in one go, and the calculation happens in the browser. For a whole file, the command line is still the most direct route: certutil -hashfile myfile.pdf SHA256 on Windows, shasum -a 256 myfile.pdf on macOS and Linux. Stick with SHA-256: MD5 and SHA-1 are still useful for spotting accidental corruption, but two different files can now be built to share the same MD5 fingerprint, so neither algorithm proves anything against deliberate tampering any more.

Five very common forms of false security

1. Renaming the extension. Turning a file from .pdf into .txt changes nothing: the header bytes identify the format in a second.
2. A ZIP with no password. An archive is only a container. And the historic ZIP encryption (ZipCrypto) has been broken for years; only the AES-256 offered by modern archiving tools is worth anything.
3. Redacting with a black rectangle. Drawing a rectangle over text in a PDF lays a shape on top; it does not remove the text underneath, and a copy and paste brings it straight back.
4. QR codes. A QR code is not encryption, it is an encoding any phone can read. Whatever it contains is public the moment somebody photographs it.
5. “It’s HTTPS, so it’s secure.” TLS encryption protects the journey between your browser and the server. It says nothing about what the server does with the file once it arrives, or how long it keeps it.

When uploading to a server is unavoidable

Some operations simply will not fit inside a tab: re-encoding a video of several hundred megabytes, rendering the pages of a PDF as images, analysing a picture to cut the subject away from the background. The browser loads the file into RAM, and a tab’s limits — very low on mobile — are reached quickly with heavy files. In those cases the upload is not a design flaw; it is the only option. Size has its own ceiling, too: each tool page states the maximum it will accept, and that is the figure to go by.

Before you drop a file anywhere, four points are quick to check.

• Is the retention period stated plainly? On Convertu, uploaded files are deleted from the servers after an hour.
• Do you have to create an account? A service that demands neither a sign-up nor an email address for a simple conversion has nothing to attach your file to.
• Where are the servers, and under which jurisdiction?
• What becomes of the download link? A result URL that never expires is a data leak sitting dormant in your browser history.

The most useful sorting, though, happens before any of this: split your files into three piles. Public or unremarkable documents can go through any decent tool. Personal documents — invoices, photos, letters — deserve a service whose network behaviour you have checked. Documents with a real secret to keep — identity documents, health records, anything covered by professional confidentiality — should not pass through any online service at all: handle those with software on your own machine.

That hierarchy is worth more than any marketing promise. On Convertu, the tools that do not need the server do not use it; the others say so, offer one conversion a day without a sign-up, and the single subscription at €7 a year lifts the limit beyond that.