Do online image compressors upload your photos?

How the test works

Marketing copy is not evidence, so we did not take any of it at face value. We built a 333.52 KB JPEG and hid a unique marker inside its EXIF data — a random string that exists nowhere else on the internet. If that string shows up in a request leaving the browser, then bytes from that file left the browser. There is no way to argue with it.

The probe photo is 341,529 bytes, 1600 × 1200, saved at quality 88 with GPS coordinates in its metadata, so it behaves like a real photograph rather than a test pattern. Its SHA-256 is f97c47b18f4a1a35c23a33822ce1e2afa833c114f545a1690085121ca6e5e209.

Then, for each tool: load the page in a headless browser, hand it the photo, press whatever button starts the work, and record every outbound request. We record from inside the page rather than from the browser's debugging protocol, because the protocol quietly drops large and streamed request bodies — using it made one upload look like a 1,144 byte request with nothing in it.

We also ran the whole thing against our own compressor as a control. A test that cannot show a file staying home is not fit to show one leaving.

Results

The two that upload

TinyPNG sent the complete file — all 341,529 bytes — and our marker was found in the request body three times. iLoveIMG sent the file to an upload endpoint as well, and the marker was found there too.

Neither is doing anything wrong. Both are server-side compressors by design: that is how the product works, and both are upfront about it. What it changes is where your photo physically goes. If the photo still carries GPS coordinates, those go with it.

The six that do not

Squoosh, CompressJPEG, ImageCompressor, JPEG Optimizer, Private Image Compressor and this site each showed our file's size in their own interface and produced a smaller version, while sending nothing large enough to have contained it. For those tools the claim checks out.

One tool, FreeConvert, we could not get to run under automation — it never displayed our file, so we recorded no verdict rather than invent one. Absence of evidence is not evidence of privacy.

What this test cannot tell you

• It is one run. One file, one browser, one day. Any of these tools can change their behaviour without saying so.
• It only sees what the page sends. What a server does with a file after receiving it — how long it keeps it, who can read it — is outside what this method can observe.
• Server-side is not the same as unsafe. Plenty of people are fine with uploading a holiday photo. This matters for contracts, medical images, ID documents and anything you would not post publicly.
• A "stays local" result is for that page on that day. Re-run it yourself before trusting it with something that matters.

Checking a compressor yourself

This takes about ten seconds and needs no tools beyond the browser you already have.

1. Open the compressor, then open developer tools (F12, or Ctrl+Shift+I) and switch to the Network tab.
2. Reload the page so the list starts clean, then add your photo and start the compression.
3. Watch the Size column. If the biggest request is a few kilobytes, your photo was processed on your machine. If one request is about the size of your photo, it was uploaded.
4. Click that large request and open Request or Payload. If you can see your image in there, it left the browser.

The full walkthrough, including what to do about it, is on our compress without uploading page.

Re-running the measurement

The probe generator and the measurement script are in the project repository, along with the raw per-site JSON this page was built from. Publish a correction if you find one — the point of writing the method down is that it can be checked.

Frequently asked questions