Verify it yourself in 10 seconds
Open DevTools → Network tab → convert any file. You will see zero upload requests. Not because we say so — because there is no server endpoint to send files to. This is an architectural guarantee, not a policy claim.
WebAssembly (WASM)
The conversion engines — libvips, libheif, libjpeg, libavif, ffmpeg — are compiled to WebAssembly: a binary instruction format that runs in modern browsers at near-native speed. When you select a file, it loads into your browser's local memory. No bytes leave your device at any point.
Image conversion: jsquash + heic2any
JPEG, PNG, WebP, and AVIF encoding/decoding uses @jsquash, a browser port of Google's Squoosh codecs. HEIC decoding uses heic2any, a port of libheif. Both are WASM modules that download once and cache locally — so subsequent visits are instant.
Video and audio: ffmpeg.wasm
Video (MP4, MKV, MOV, AVI, WebM, WMV) and audio (MP3, WAV, OGG, FLAC, M4A, Opus) conversions use ffmpeg.wasm — the full production ffmpeg codebase compiled to WebAssembly. Every codec runs locally. The first load takes 5–20 seconds depending on connection; every conversion after that is instant.
Documents: pdf-lib and pdfjs-dist
PDF rendering (PDF → PNG) uses pdfjs-dist from Mozilla. PDF creation uses pdf-lib. DOCX extraction uses mammoth. All three are pure JavaScript / WASM — no server component whatsoever.
Watermarks — applied locally
Free-tier image conversions get a subtle formatdrop.com watermark added via the browser Canvas API before download. This happens entirely on your device — there is no server-side rendering step. Pro removes it. The point: even the watermark doesn't touch our servers.
Server architecture: intentionally minimal
Our backend does exactly three things: receive a Stripe webhook, write Pro status to Redis, and send a magic-link email. That's the entire surface area. We deliberately built it this way so there is nothing to breach. Your files are never a server concern.
Open source
The WASM conversion wrappers used by FormatDrop are open-sourced. You can inspect, fork, or audit the conversion logic. No black boxes.
No account required. No file upload. Ever.