Your files stay put

Short version: every Rounder tool runs inside your browser. Your files and the text you type are read, processed and saved on your own device. We never send them anywhere, and you don't have to take our word for it: below is how to check, plus the complete list of everything the site does connect to.

How it works

When you open a tool, your browser downloads the page and a small program (JavaScript and WebAssembly) from our site. When you drop a file in, the browser hands it to that program in memory. The work happens on your device, often in a background thread, and the result is built in memory too. "Download" saves it straight from your browser to your disk. There is no upload step, no server that processes files, and no database. Rounder is a static website.

Check it yourself

Watch the Network tab

1. Open a tool, for example Compress PDF.
2. Open your browser's developer tools (F12, or Cmd+Option+I on a Mac) and pick the Network tab.
3. Clear the list, then use the tool on a file.
4. Look at what appears. You'll see files loading from roundertools.com (program code, fonts), and maybe analytics or ad requests. You won't see a request carrying your file: no upload, and no request anywhere near your file's size.

Use airplane mode

1. Open a tool and let the page finish loading. For AI tools, run them once so the model is downloaded.
2. Turn off Wi-Fi or switch on airplane mode.
3. Use the tool. It keeps working, because processing your file doesn't need the internet. (The few tools that fetch something, like exchange rates or a new OCR language, are listed below.)

And because the whole site is open source, you (or someone you trust) can read exactly what every tool does.

Every network request the site makes

This is the complete list. If you find a request that isn't here, that's a bug, so please tell us.

• Rounder itself (roundertools.com, hosted on Cloudflare Pages): pages, program code, fonts and some small model files. Like any web host, Cloudflare sees basic request details such as your IP address and browser.
• Cloudflare Web Analytics (cloudflareinsights.com): counts page views and measures load speed. It sets no cookies and doesn't track you across sites. It never sees files or tool input.
• Google AdSense, on pages that show ads: Google's ad code (from domains such as googlesyndication.com, doubleclick.net and gstatic.com) and, in the EEA, the UK, Switzerland and some US states, Google's consent message, which loads from another Google domain. The ads themselves load inside their own frames, and an ad can pull its images, video and measurement pixels from the advertiser's or other ad companies' servers. Seeads and your input below.
• Hugging Face (huggingface.co and its download servers): AI tools download their model the first time you use them, after asking you, pinned to an exact version. The video background remover gets its small model from Google's model storage (storage.googleapis.com) instead. Models are cached in your browser, so this happens once.
• jsDelivr (cdn.jsdelivr.net): Image to text and Scanned PDF to searchable PDFdownload the language data for the languages you pick.
• Frankfurter (api.frankfurter.dev): the currency converter fetches European Central Bank reference rates. Only the request for rates is sent, never your amounts.
• Have I Been Pwned (api.pwnedpasswords.com): the password strength checker checks breaches only when you click to. It sends the first 5 characters of the password's SHA-1 hash, never the password, and the match happens on your device.
• Images you link to: the Markdown editor,Markdown to PDF and HTML to PDF show images your document links to, and the email signature generator previews the photo or logo address you enter. Your browser loads those images from wherever they're hosted. That site sees your IP address and, at most, that the request came from roundertools.com, never which page or what else is in your document.
• Your browser's own AI: in Chrome, the translator, summarizer, paraphraser and grammar checker can use the AI model built into the browser. If Chrome needs to download that model, Chrome does it, from Google. The text you process still stays on your device.

A service worker (part of our site, running in your browser) keeps a copy of pages you've visited so they work offline. It only ever talks to roundertools.com.

Ads and your input

Rounder is kept free by light ads from Google. We never send your files or what you type to Google or anyone else. But to be straight with you: ad code, on Rounder as on any website with ads, runs inside the page, and the page is where your tool is. We don't write that code and can't fully control what it does.

That's why the tools where it matters most carry no ads and no consent scripts at all. They handle passwords, keys, tokens and documents you're trying to protect:

• Password generator
• Encrypt & decrypt files
• JWT decoder
• Password strength checker
• Protect PDF
• Redact PDF
• Unlock PDF

Pages about the site itself (this one, privacy, terms,about and the like) are ad-free too. Ads are never placed inside a tool or next to a download button.

Security headers

Every page is served with:

• Strict-Transport-Security: HTTPS only, for a year, on every subdomain.
• X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN: no content-type guessing, and other sites can't frame our pages.
• Referrer-Policy: strict-origin-when-cross-origin: other sites see at most "roundertools.com", never the page you were on.
• Permissions-Policy: the camera, microphone and screen capture are available only to our own pages (for the recorders, and only when you allow it); location, payments and USB are switched off.

We don't send cross-origin isolation headers (COOP/COEP), because they break ad frames. Tools are built to work without them. We don't send a Content Security Policy yet either: ad code loads from many Google domains, and a policy loose enough for that would add little.

Reporting a security problem

Found a vulnerability? Please email hello@roundertools.com or open aprivate advisory on GitHub, and give us a reasonable chance to fix it before you share it publicly. We won't take action against good-faith research that avoids harm to people and their data. Oursecurity.txt has the same details.