Free tools that run on your computer, not on a server
What "nothing is uploaded" actually means on this site, how to check it for yourself, and the handful of places it does not apply.
Almost every tool on johnmcm.com does its work inside the browser tab you have open. You pick a file, the page reads it into memory, changes it, and hands the result back as a download. At no point does the file travel to a server — not mine, not anyone's.
That is unusual. Most free online converters work the other way round: you upload, a machine somewhere does the job, and you download the result. The tool is free because your file paid for it.
How a browser tool actually works
When you choose a file, the browser does not send it anywhere. It hands the page a reference, and JavaScript reads the bytes into memory. Everything after that happens locally:
- The libraries run in the page. The SQL Playground is SQLite compiled to WebAssembly. The OCR Toolkit is the Tesseract engine, also compiled to WebAssembly, downloaded to your browser and run there. The PDF tools use pdf-lib and PDF.js. These are the same engines a desktop program would use — they are simply running in the tab.
- The result is built locally too. When you press download, the page makes a blob in memory and points a link at it. The file appears in your downloads folder without a round trip.
- It keeps working offline. Once a tool has loaded everything it needs, you can disconnect from the internet and it will still run. A few of them fetch a large library or a language model from a CDN the first time you use them, so give it one run before you test that.
Why it is worth caring about
"Nothing is uploaded" sounds like a technicality until you look at what people actually put into these tools.
- Documents are often confidential. Contracts, payslips, medical letters, passports, tenancy agreements. Merging two PDFs on a random website means handing that document to a company you know nothing about, under a retention policy you have not read.
- Photographs carry more than the picture. A phone photo usually has GPS coordinates, a timestamp and the camera's serial number in its EXIF data. Resizing it here strips or keeps that data on your machine, rather than on someone else's.
- Some pastes are credentials. A JSON Web Token is a password in disguise. Pasting one into an online decoder is handing over a working key — which is why the JWT Decoder here never sends it anywhere. The same goes for config files with database passwords in them.
- There is no upload limit to run into. Nothing is being transferred, so a 400 MB video or a 200 MB database is limited by your own machine's memory rather than by a free tier.
- There is no account, so there is nothing to breach. The site holds no password of yours, because it never asked for one.
Do not take my word for it — check
This is a claim you can verify in about thirty seconds, and you should, here or anywhere else that makes it.
- Watch the network. Open any tool, press F12 for developer tools, and pick the Network tab. Now do the job — merge the PDF, resize the image, run the query. Nothing carrying your file will appear.
- Or pull the plug. Load the tool, use it once so anything it downloads is cached, then turn off your wi-fi and use it again. A tool that needed a server would stop working; these do not.
Where this does not apply
A privacy claim is only worth anything if the exceptions come with it. These are all of them.
- ZIP to Text does upload. It sends the archive to this site's own API, which joins the files inside it into one text document and streams it back. The archive is held in memory for the length of the request and never written to disk, and the limit is 25 MB. If that is not acceptable for a given file, do not use this one.
- Math Drills does too. Problems are generated and answers are graded by the API, so the answers leave the machine. Nothing is stored — there is no database behind it and no record of who answered what.
- The GPX Viewer fetches map tiles. Your track is read and drawn locally, but the map underneath it comes from openstreetmap.org, so those tile requests do leave your browser.
- Colin's Clicker is a download. It is a Windows program, not a browser tool, so none of the above describes it.
- Some libraries load from a public CDN. The first time you open a tool that needs a big library, it is fetched from a CDN and then cached by your browser. That request tells the CDN you loaded the library; it does not carry your file. The fonts come from Google Fonts the same way. Everything used is listed on the open source licences page.
- Page visits are counted. The site runs a self-hosted Umami instance on my own server — no cookies, no cross-site profile, no personal data, and nothing about what you put into a tool. It records that a page was viewed, which is how I know which tools are worth working on.
And it is genuinely free
No ads, no sign-up, no trial, no watermark on the output, and no paid tier holding the useful half back. This is a personal site, the tools are small, and running them costs me almost nothing precisely because your files are not passing through my server.