Security

This page is written for whoever has to approve the site, not for whoever wants to use it. It is short on purpose, and everything in it can be checked from outside without asking us.

What the tools do with a file

Nothing on this site uploads a file. Every tool reads what you give it with the browser's own file API, does its work in the page, and hands the result back as a download. There is no upload endpoint to send a file to, because there is no server-side code at all: the site is static files behind a CDN.

That is a claim you can verify rather than accept. Open your browser's developer tools, switch to the Network tab, and use any tool on the site. The file you chose does not appear in the list.

The Content Security Policy we send

The site’s security policy sets connect-src ‘none’, so the browser blocks network requests from these pages. This is the exact header the site returns on every page, and it is generated from the same source as the page you are reading, so it cannot drift from what the edge is actually sending:

default-src 'self';
script-src 'self';
style-src 'self';
img-src 'self' data:;
font-src 'self';
worker-src 'self';
connect-src 'none';
frame-ancestors 'none';
form-action 'none';
base-uri 'none';
object-src 'none'

Check it yourself with curl -I https://lightutils.com/, or in the Network tab under the response headers for any page.

What runs in the page

• No analytics, no tag manager, no session recorder, no heatmap, no A/B testing script.
• No fonts, scripts or stylesheets from another host. script-src 'self' and style-src 'self' make that enforceable rather than a promise.
• No cookies are set by any tool. The only browser storage used is a single entry recording whether you dismissed the cookie notice, and the language you last chose.
• No account, no sign-in, no email address collected.

Where the code runs

Everything is plain JavaScript modules served from this origin. There is no bundler and no runtime dependency from a package registry, so there is no third-party code in the pages and no supply chain to audit beyond the browser itself. Some tools use a Web Worker, also served from this origin.

Two tools use WebCodecs, the browser's own video encoder and decoder. That is the same component the browser uses to play video and it runs locally.

What leaves your browser

The page itself, its stylesheet, its scripts and its images, fetched from this origin when you load a page. That is all. No tool sends anything, and the policy above prevents it from doing so even if the code tried.

If this changes

We intend to show advertising, which would mean allowing the advertiser's script and its network requests. If and when that happens, the policy printed above changes with it and this page changes automatically, because both are generated from one definition. The files you process would still never be uploaded. That part is a property of how the tools are built, not of the policy.

Reporting something

If you find a security problem, write to privacy@lightutils.com. Please include enough detail to reproduce it. We do not run a paid bounty.