Security
Updated: 2026-09-24
In one line
There is no upload. The code that reads and converts your files runs inside your browser. It is not that we choose not to send them — there is no code that could. We have nowhere to store your files and nothing to delete.
Check it yourself (30 seconds)
Rather than asking for trust, here is how to verify.
① Go offline. Open a tool page, turn off Wi-Fi, then drop a file in. It still works; anything server-based would stop here.
② Open DevTools → Network and drop a file in. No request carries your file.
③ This site serves static files only, so no upload endpoint exists to receive one.
Why it matters
Report cards, contracts, ID scans and official letters uploaded to a conversion site end up on someone else's server, with no way for you to check the retention period, who can read them, or whether they leaked. Keepdesk removes the risk itself: not by guarding your files well, but by never holding them.
What is stored
No files at all. A few tools (character counter, text cleaner, text compare, JSON formatter) keep your last input in your browser's own storage (localStorage) for convenience. It is never transmitted and can be cleared through your browser's site-data settings. See the privacy policy for details.
Access logs
Serving a website means the host (Cloudflare) records standard access logs: IP address, browser type, time and requested path. Every website does this, and it has nothing to do with file contents. We do not use these logs to identify individuals.
Security policies applied to every page
Rules the browser enforces, actually switched on here.
· Content Security Policy: scripts and connections are limited to our own domain and the Google addresses needed for ads (Google AdSense) and visit statistics (Google Analytics). Other third-party scripts cannot slip in, and inline scripts are not allowed.
· Local Shield: the moment you add a file or text, the tab's main outbound channels (fetch, XHR, WebSocket, beacon, forms) are locked to our own site — details.
· HTTPS enforced and frame-ancestors 'self': no interception in transit, and no other site can frame our pages to trick you (only our own studio may embed our tools).
· Ads: Google AdSense ads keep the site free, and Google uses ad cookies.
· Visit statistics: cookie-free Cloudflare Web Analytics aggregates plus Google Analytics (_ga cookie). Google receives page addresses, titles and usage events such as file extensions and counts — never file names, contents or text you type — and nothing is sent from a tab Local Shield has locked. See the privacy policy.
Limits, stated plainly
· If the browser itself is compromised or carries a malicious extension, no website is safe.
· Once you upload the result somewhere, that service's policy applies.
· Redaction and watermarks apply to the newly saved file only; sending the original alongside defeats them.
· HWP and PDF rendering uses open-source implementations and may differ from the original. Check important documents against the source.
Found a problem?
If you believe you have found a security issue, please write to help@keepdesk.app and give us time to fix it before disclosure. Every open-source component and licence we use is listed on the open source page.