Skip to content
brownie.tools

Security Model

Your files never leave your device. Every tool on brownie.tools processes data entirely in your browser using native APIs. There is no upload, no server, no cloud storage. This page explains exactly how we enforce this guarantee - technically, not just by policy.

Zero Network Transfers During Processing

When you convert an image, count characters, or calculate a percentage on brownie.tools, the tool code runs entirely within your browser's JavaScript engine. The file you select is read into your browser's memory using the File API, processed using native Canvas API, Web Crypto API, or plain JavaScript, and the result is made available for download - all without a single network request.

You can verify this yourself: open your browser's DevTools (F12), switch to the Network tab, and perform any conversion. You will see zero outbound requests during processing. In fact, you can disconnect from the internet after the page loads and every tool will continue to work normally.

Content Security Policy (CSP)

We enforce a strict Content Security Policy that prevents tool pages from making network requests to external servers. This is a browser-level security mechanism - not a setting we can override in JavaScript. Our CSP headers are: 

default-src 'self';
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
connect-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' data: blob:;
worker-src 'self' blob:;
font-src 'self';
frame-ancestors 'none';

The connect-src directive permits connections only to this site. Tool code processes your files locally without network requests; engines and models are served from this site. The frame-ancestors 'none' directive prevents other sites from embedding our tools in iframes.

What Data Stays on Your Device

  • Files you process: Loaded into browser memory, processed, then available for download. After you leave the page or close the tab, the data is released from memory.
  • Cookies: We set zero cookies. No session cookies, no tracking cookies, no analytics cookies.
  • localStorage: Optionally used for theme preference (dark/light) and recent tools list (if you enable it). No file data is ever written to localStorage.
  • Analytics: We use Google Search Console for search performance data (no user tracking, no cookies). No client-side analytics library is loaded.

Engines and Models Served from This Site

JavaScript engines, WebAssembly modules, and models are served from this site, including OCR assets under /vendor/tesseract. Tools load the assets they need from the same origin before processing locally. There is no external CDN fallback.

Additional Security Headers

Header Value Purpose
X-Content-Type-Options nosniff Prevents MIME type confusion attacks
X-Frame-Options DENY Prevents clickjacking via iframes
Referrer-Policy strict-origin-when-cross-origin Limits referrer data sent to external sites
Permissions-Policy camera=(), microphone=(), geolocation=() Disables hardware access APIs not needed by tools

What We Do Not Do

  • We do not upload your files to any server, ever.
  • We do not use eval() or new Function() in tool code.
  • We do not set cookies or use fingerprinting techniques.
  • We do not load third-party advertising or tracking scripts.
  • We do not store file data in localStorage, IndexedDB, or any persistent storage.
  • We do not collect or transmit error logs automatically (errors are only reported if you choose to submit feedback).

Open Questions and Transparency

If you have questions about our security model, find a vulnerability, or want to suggest improvements, please use the feedback button on any tool page. We take security reports seriously and will respond to all credible reports.

This security model page was last updated on .