You need three PDFs merged in a hurry, so you search, find a converter, and drop the files in. And a second after clicking, you think: hang on, was that fine?
Nine times out of ten nothing comes of it. But having that thought every single time is unsettling — and when the file was a work document, it tends to come back to you an hour later as a slightly unpleasant feeling.
This piece is about the fact that online tools come in two quite different shapes, and about how to tell which one is in front of you. Not about whether to believe somebody who says "your files are safe" — about how to check.
What uploading actually does
A typical online converter sends your file to that site’s server, does the work there, and sends the result back. That design has genuine advantages: heavy work finishes fast, an old laptop performs like a new one, and it is far simpler to build.
The cost is that a copy of your file now sits on somebody else’s computer. When it gets deleted, and who can read it in the meantime, is something you can only take on faith from what the site says.
And this is not a story about bad actors. A perfectly honest operation still runs automatic backups, keeps logs to diagnose failures, and lets a contractor in to maintain the machines. "We delete files immediately" can be entirely true and still leave the hours before deletion, and whatever the backup swept up, outside the promise.
The other shape — everything inside the browser
Browsers have quietly become capable of a lot. Analysing audio, compressing video, rebuilding PDFs, even running AI models — all of it can happen inside the page. Which means the same job can be done without sending anything anywhere.
Built that way, the earlier worry disappears rather than being answered. There is no deletion policy to believe, because nothing was handed over.
It has real weaknesses too. Speed depends on your machine, so an old laptop makes you wait. Large AI models will not load on a phone with little memory. Very big files can take the tab down with them. There are jobs the upload model is simply better at.
Telling which one you are looking at
Here is the part worth keeping. Judge by how the thing behaves, not by whether the page says "secure". Three methods, in increasing order of certainty.
1. Notice what you are waiting for
The quickest test. Upload-based tools make you wait longest at the start, and that wait scales with file size and gets obviously worse on a weak connection. In-browser tools barely pause at the start and instead heat your laptop up and spin the fan while they work. Are you waiting on the network, or on your own machine? That alone usually settles it.
2. Turn the network off
Load the page, disconnect, and see whether it still works. One caveat: sites that fetch the heavy parts on demand will not work if you have never used the tool before, because the code is not on your device yet. So the order to test in is: use it properly once, then disconnect and use it again.
3. Watch the actual requests
The definitive one. Open developer tools (F12 on Windows, ⌘+⌥+I on a Mac), leave the Network tab showing, and run the tool. Every request the page makes appears there.
Something to say before you do that: requests will appear. Ads, analytics, fonts. Any site running for free will show you something. If seeing those makes you conclude "so it does phone home", the whole method stops being usable.
What matters is not whether there is traffic, but whether your file is in it. An ad request is a few kilobytes. If the 10 MB PDF you dropped in had been sent, there would be a 10 MB row. There is not one, so it was not sent.
When the files belong to your employer
At work this gets harder, because what an IT department wants confirmed is not "this site makes no requests" — it is "our files are not leaving". The first claim is false, and the second cannot be established by asserting it.
That is what the what is sent page here exists for. It names every destination first, then sets out in a table what those requests do not carry. It is written as evidence rather than as marketing, so it is meant to be forwarded internally as-is.
Even so, seeing it yourself beats reading about it. Method 3 above works on any site — including this one. Please do.
How this site is built
For completeness: every tool on StemStudio is the in-browser kind. Stem separation, file conversion, image and video compression and merging PDFs all finish inside your browser.
A handful are exceptions, necessarily. Finding your public IP needs one request, because that address is only visible from the outside. DNS lookups send the domain you type to a public resolver. A speed test cannot measure anything without moving data. Weather and earthquake read published data from the meteorological agency. For those five, communicating *is* the job. Rather than quietly claiming everything is local, that disclosure page lists them.
So: notice what you are waiting for, pull the network, open the Network tab. Three checks, and you can answer the question yourself instead of deciding whose promise to believe. It is considerably faster than worrying.
The stem separation in this article runs free in your browser — no sign-up, and your audio never leaves your device.