anizel
Home / How it works

Nothing you drop into Anizel is uploaded. Here's how you can prove it.

Every one of the 40 tools on this site runs on your own computer or phone — inside your web browser, using JavaScript. There is no upload step and no server doing the work on your files. You don't have to trust that: you can watch.

The 60-second test

  1. Open a tool. Any of them — Merge PDF, Compress Image, Protect PDF, whatever you use.
  2. Open your browser's DevTools. Press F12 (or ⌘⌥I on Mac) and click the Network tab. Tick Preserve log if you see it. This tab lists every single byte your browser sends anywhere.
  3. Clear the log, then drop your file onto the tool. Sensitive contracts, ID scans, photos — whatever you were about to use it for.
  4. Click the button to run the tool. Merge, compress, convert, whatever.
  5. Look at the Network tab. You'll see no request carrying your file. No POST to a server, no upload progress, no data going out. The file is opened by the JavaScript in the page you're already on and the result is saved straight back to your device.

If we were secretly uploading your file, it would show up in that Network tab. It doesn't — because we aren't.

How it actually works

Modern browsers can do everything a server used to do. When you drop a file onto one of our tools, it's read into memory by JavaScript (using the browser's built-in File API), processed by an open-source library also running in your browser (pdf-lib, PDF.js, Tesseract's WebAssembly, and so on), and the result is handed straight back to a download link. Your computer is doing the work. Ours isn't even involved.

The whole site is static HTML, CSS and JavaScript — the same kind of files you'd get from opening a plain document. We couldn't process your files on a server even if we wanted to: there isn't one behind these tools.

The libraries doing the work

None of this is our invention — we're standing on years of excellent open-source work. Every library that touches your files ships with source code you can inspect:

All of these are copied straight into /assets/vendor/ on this site and served from anizel.com itself — not fetched from a third-party CDN at runtime. That was a deliberate choice, so that a compromised CDN can never inject malicious code onto a page while you're using it.

What actually crosses the network

To be honest and specific, here is every network request Anizel can make, and none of them involve your file bytes:

That's it. There is no other outbound traffic. There is no place we could put a "silent upload" — the Network tab would give it away instantly.

Don't take our word for it — your browser enforces it

Every page on anizel.com ships with a Content-Security-Policy header. That's not a promise from us — it's an instruction to your browser: refuse to let this page talk to anything except the short list below. Even if our code were somehow compromised, the browser would block an upload before a single byte left your machine. This is the actual policy, verbatim (line-wrapped for readability):

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'wasm-unsafe-eval' https://gc.zgo.at
             https://*.googlesyndication.com https://*.doubleclick.net
             https://*.googletagservices.com https://adservice.google.com
             https://*.adtrafficquality.google
             https://fundingchoicesmessages.google.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' blob: data: https://anizel.goatcounter.com
          https://*.googlesyndication.com https://*.doubleclick.net
          https://*.google.com https://*.gstatic.com
          https://*.googleadservices.com;
  font-src 'self' data:;
  connect-src 'self' blob: data: https://anizel.goatcounter.com
              https://tessdata.projectnaptha.com
              https://huggingface.co https://*.huggingface.co https://*.hf.co
              https://pagead2.googlesyndication.com
              https://googleads.g.doubleclick.net
              https://ep1.adtrafficquality.google https://csi.gstatic.com
              https://fundingchoicesmessages.google.com;
  media-src 'self' blob: data:;
  worker-src 'self' blob:;
  frame-src 'self' https://*.googlesyndication.com https://*.doubleclick.net
            https://*.adtrafficquality.google
            https://fundingchoicesmessages.google.com https://www.google.com;
  manifest-src 'self'; object-src 'none';
  base-uri 'self'; form-action 'self'; frame-ancestors 'self'

Translated: pages on this site may talk to anizel.com itself, to the anonymous analytics ping, to the OCR language-model CDN, and to Google's disclosed ad hosts — and to nothing else. The hosts that pay the bills are pinned to the same short list as everything else: nothing that touches your files ever sends them anywhere, and an undisclosed server simply isn't reachable. No inline scripts are allowed either. To see the header yourself: DevTools → Network → click the first request → Headers → content-security-policy.

The little "0 uploads" badge in the corner of every tool page is watching this live: it counts every network request the page makes and turns red if anything undisclosed is ever contacted. It never has been.

And the entire site is open source, so you can read every line of code that touches your files: github.com/anissmail-2/SITE_CODE.

Install it — work offline forever

Anizel is a Progressive Web App. Click the install icon in your browser's address bar (or "Add to Home Screen" on mobile) and it becomes a real app on your device. After that, the whole site — every tool, every library — works with no internet at all. Try it: install, turn on airplane mode, merge two PDFs.

That's the ultimate demonstration that nothing is uploaded. It couldn't be, because there's nowhere for it to go.

Who's behind this

Anizel is a small project built to make the everyday file jobs — merging PDFs, compressing photos, zipping folders — take five seconds instead of five clicks on a paywalled competitor. It's free, it always will be, and it has no premium tier hiding the useful features. If you find something we should add, get in touch.

Ready?

Pick a tool →