Think about the last file you converted online. Maybe a contract into PDF, a passport scan into a smaller JPG, a voice memo into something your editor could open. Now ask: where did that file go?
For nearly every converter site on the internet, the answer is: onto their servers. Your file was uploaded, processed on a machine you'll never see, stored for some window of time defined in a privacy policy you didn't read, and then, hopefully, deleted. The whole transaction runs on trust in a company whose name you learned thirty seconds ago.
The upload model, and what it costs you
Upload-based conversion isn't malicious by default; it's just how the web worked when these sites were built. Conversion software ran on servers, so files had to travel. But the model has real costs:
- Exposure. Your file crosses the network and sits on third-party disks. Breaches, subpoenas, misconfigured buckets, and curious employees are all now part of your file's threat model.
- Retention you can't verify. "Files are deleted after 2 hours" is a promise, not a property. You cannot audit it.
- Artificial scarcity. Server processing costs the company money, which is why upload converters meter you: two free files a day, 25 MB caps, watermarks, accounts. The limits aren't product decisions; they're server bills passed to you.
What changed: the browser grew up
The quiet revolution is called WebAssembly. It lets real, battle-tested software, the same open-source engines professionals use, run inside your browser at near-native speed.
FFmpeg, the engine behind most of the world's video processing, compiles to WebAssembly. So do PDF renderers, image codecs, and document parsers. Which means the conversion can happen on your machine, in the browser tab you already have open. The file never crosses the network because there is no reason for it to.
When you convert HEIC to JPG or MP4 to MP3 on FormatFusion, here's the entire journey of your file: from a folder on your device, into your browser's memory, through a conversion engine running locally, back to a folder on your device. Our server's role is delivering the web page. It never sees a single byte of your file, and that's not a policy, it's the architecture. There's nothing to delete because nothing ever arrived.
The honest tradeoffs
Client-side conversion isn't magic, and we'd rather you know its edges:
- Your hardware does the work. Converting a two-hour video happens at your laptop's speed, not a data center's. For images and documents the difference is imperceptible; for big video jobs, a server farm would win.
- First-time engine download. Media conversions fetch the FFmpeg engine once (about 31 MB), then cache it. That's engine code coming down, never your files going up.
- The browser is the ceiling. Memory limits mean a 1.5 GB video is the practical maximum. Frontier cases still belong to desktop software.
For the conversions people do every day, those tradeoffs are invisible, and what you get back is the thing that used to be impossible: certainty.
Why this matters beyond converters
The bigger point is about defaults. For twenty years, "put it in the cloud" was the answer to everything, and we normalized sending our most personal files to machines we don't control for tasks our own machines could handle. Browsers quietly ended that necessity for a whole class of tools. Converters were our start because the mismatch was so absurd: uploading your tax documents to a stranger to change three letters at the end of a filename.
Photographs, contracts, medical records, drafts. The tools that touch them should come to your data, not the other way around.
That's the whole philosophy behind FormatFusion. Free because your conversions cost us nothing to serve. Private because the files never leave. And if you want the tools that use this same principle for storing and sending files, we keep an honest list in our privacy-first storage guide.