Local Tools Online

Architecture & Security Overview

How Our Tools Work

Most “free” online converters work the same way: you upload your file to their server, they process it remotely, and your data sits on infrastructure you don’t control — sometimes cached, sometimes logged, sometimes shared with third parties you’ll never know about.

runlocaltools.online works differently. Every tool runs entirely inside your browser. Your files are never uploaded anywhere, because there’s no server-side processing step to upload them to.

What actually happens on your device

  • WebAssembly (WASM): For heavier media work — video trimming, GIF conversion, audio processing — we run compiled native libraries (like FFmpeg) directly in your browser’s runtime. Large files are processed in your device’s own memory and never leave it.
  • HTML5 Canvas API: Image tools — merging, resizing, redaction, background editing — manipulate pixels on a local canvas element. Downloads are generated as local data URLs, not fetched from a server.
  • Client-side parsing libraries (pdf-lib, and others): PDFs, spreadsheets, and structured text formats are parsed and rewritten entirely in local memory using JavaScript libraries running in your browser.
  • localStorage (not a cloud account): We don’t have user accounts or a backend database. If a tool remembers your last settings, that’s stored in your browser’s local storage only — we have no way to see or access it. Note this isn’t encrypted storage; treat it like any other browser data on a shared device.

On compliance

Because your files never transmit to servers, this architecture removes an entire category of data-exposure risk that server-based tools carry. That said, we’re not going to claim “full GDPR/HIPAA compliance” as a blanket legal statement — compliance depends on more than where processing happens (breach procedures, agreements, audit practices, etc.), and we’re not a compliance vendor. What we can say plainly: we have nothing to leak, because we never receive your data in the first place. If your organization needs that architecture documented for a compliance review, get in touch and we can walk through specifics.

What we don’t do

No analytics wrappers, no ad trackers, no third-party scripts reading your activity. The only thing that touches a server is the static site itself (HTML/CSS/JS) — the same way any website has to be hosted somewhere to reach your browser. Nothing about your data touches that server.