How to check if a website uploads your file

“Your data never leaves your device” is easy to write on a landing page. You don’t have to take it on trust. Your browser already has the tools to check, and none of them need you to read the site’s code.

Check 1: watch the Network tab

Open the browser’s developer tools (F12, or Cmd+Option+I on a Mac), switch to the Network tab, and only then open your file in the tool. Every request the page makes appears in the list.

Filter by Fetch/XHR and look at the Method column. Downloads are GET requests. Anything that sends data out is usually a POST or PUT, and its Payload tab shows exactly what went. A request whose size grows with your file is the giveaway. Also check the WS filter for WebSockets, and requests of type “ping”, which is how beacons appear.

Check 2: go offline

Load the tool, turn off Wi-Fi, then open your file and use it. If the analysis still works, the processing happens in your browser. A tool that uploads files fails right away.

This test has a gap: a page could keep your data and send it once you reconnect. So run it together with check 1, and keep the Network tab open after Wi-Fi comes back.

Check 3: read the Content-Security-Policy

In the Network tab, click the first request (the page itself) and look under Response headers for content-security-policy. Its connect-src part lists the only places the page’s scripts are allowed to send requests to, and the browser blocks everything else, whatever the code tries.

If connect-src is just 'self', the page can only talk to its own server, so you only have to trust one party. If the header is missing, or lists analytics and API domains, the page is allowed to send data to those places. That doesn’t mean it does, but nothing stops it.

What these checks can’t prove

They show what happened in your session, not what the next version of the site will do. A policy doesn’t cover every route either: a page can still leak data by navigating the whole tab to another address, though you’d see the address bar change. Browser extensions can read pages regardless of the site’s policy.

Even so, the three checks together catch the common cases: silent uploads, analytics that capture content, and “local” tools that quietly call a cloud API.

How NoEgress makes this easier

Every NoEgress page is served with a policy that only allows connections to no-egress.com itself and to a model server on your own machine. In the workspace, the “0 sent” badge opens a list of every request the page made, grouped by what it could carry, and lets you download it as a receipt for your compliance team.

Run the three checks on it anyway. That’s the point.