The upload nobody reads the fine print about

Drop a photo into a typical online compressor and something has to give: your image is uploaded to a machine you do not control, processed there, and handed back. The privacy promise lives in a policy page; the actual exposure happens in the network tab before you ever read it.

For many images that is harmless. For the ones that are not — an ID document, a screenshot with an address in it, a photo of a whiteboard — 'we promise to delete it' is a much weaker guarantee than 'it never left your computer.'

WebAssembly: a codec on your machine

The trick that lets a web page do real compression without a server is WebAssembly — compiled, sandboxed code that runs inside the browser at near-native speed. The codecs that shrink AVIF, WebP, JPEG and PNG can be compiled to WebAssembly and shipped to the page once, then reused.

From that point the browser is the server. The pixels are read, transformed and written back entirely within your device. There is no upload step to opt out of, because there is no upload.

Privacy you can verify, not just trust

The difference between privacy-by-policy and privacy-by-architecture is whether you have to believe anyone. Open the developer tools' network panel and compress an image: you will see the page load its codecs, and then nothing leaves your machine. The guarantee is not a paragraph of text — it is an absence of requests you can watch for yourself.

The trade-offs we accepted

Client-side is not free. Choosing it means accepting real costs, honestly:

  • The first run has to download the codecs, so it is slower than a tiny server-side job — after that they are cached.
  • Very old or memory-starved devices may struggle with large images that a big server would shrug off.
  • You cannot compress a hundred gigabytes overnight while you sleep; the work happens while your browser is open.
  • For the images people actually care about keeping private, we think those are the right trade-offs to make.

Offline as a side effect of good architecture

Because the whole tool runs on your device once the codecs are cached, it keeps working with the network switched off. That was not a feature we had to build — it fell out of the decision to never depend on a server in the first place. Good constraints tend to produce good accidents.