Do online image compressors upload your photos?

How the test works

Marketing copy is not evidence, so we did not take any of it at face value. We built a 333.52 KB JPEG and hid a unique marker inside its EXIF data — a random string that exists nowhere else on the internet. If that string shows up in a request leaving the browser, then bytes from that file left the browser. There is no way to argue with it.

The probe photo is 341,529 bytes, 1600 × 1200, saved at quality 88 with GPS coordinates in its metadata, so it behaves like a real photograph rather than a test pattern. Its SHA-256 is 16fd7e80a37e0988544a678263f945c87cb9c08a57a580dbff5a173ece97c61c.

Then, for each tool: load the page in a headless browser, hand it the photo, press whatever button starts the work, and record every outbound request. We record from inside the page rather than from the browser's debugging protocol, because the protocol quietly drops large and streamed request bodies — using it made one upload look like a 1,144 byte request with nothing in it.

We also ran the whole thing against our own compressor as a control. A test that cannot show a file staying home is not fit to show one leaving.

Results

The two that upload

TinyPNG sent the complete file — all 341,529 bytes — and our marker was found in the request body three times. iLoveIMG sent the file to an upload endpoint as well, and the marker was found there too.

Neither is doing anything wrong. Both are server-side compressors by design: that is how the product works, and both are upfront about it. What it changes is where your photo physically goes. If the photo still carries GPS coordinates, those go with it.

The seven that do not

Squoosh, CompressJPEG, ImageCompressor, JPEG Optimizer, Private Image Compressor, compressimage.net and this site each showed our file's size in their own interface and produced a smaller version, while sending nothing large enough to have contained it. For those tools the claim checks out.

The six we could not reach a verdict on

Six of the fifteen never ran under automation: FreeConvert, CompressPNG, iLoveIMG's JPG page, BulkCompressor, imagecompress.com and resizeimage.net. Each one either never displayed the file in a way our script could drive, or no longer serves the address we tested — resizeimage.net did not resolve at all, which is its own answer about the tool, not about its traffic.

These rows are blank on purpose. A tool we failed to start is not a tool that respects your privacy, and filling the cell with a guess would turn this into the kind of claim we set out to check. If you want these six tested, the script takes one site id at a time and the raw JSON shows exactly where each run stopped.

What this test cannot tell you

• It is one run. One file, one browser, one day. Any of these tools can change their behaviour without saying so.
• It only sees what the page sends. What a server does with a file after receiving it — how long it keeps it, who can read it — is outside what this method can observe.
• Server-side is not the same as unsafe. Plenty of people are fine with uploading a holiday photo. This matters for contracts, medical images, ID documents and anything you would not post publicly.
• A "stays local" result is for that page on that day. Re-run it yourself before trusting it with something that matters.

Checking a compressor yourself

This takes about ten seconds and needs no tools beyond the browser you already have.

1. Open the compressor, then open developer tools (F12, or Ctrl+Shift+I) and switch to the Network tab.
2. Reload the page so the list starts clean, then add your photo and start the compression.
3. Watch the Size column. If the biggest request is a few kilobytes, your photo was processed on your machine. If one request is about the size of your photo, it was uploaded.
4. Click that large request and open Request or Payload. If you can see your image in there, it left the browser.

The full walkthrough, including what to do about it, is on our compress without uploading page.

Re-running the measurement

The probe generator and the measurement script are in the project repository (MIT), along with the raw per-site JSON this page was built from. Publish a correction if you find one — the point of writing the method down is that it can be checked.

Frequently asked questions