PrivateCSV

How PrivateCSV works, and how to check it

Every PrivateCSV tool runs inside your web browser. Your file is read, processed and turned into a result on your own device, and it is never sent to a server. This page explains how that works and how you can verify it without taking our word for it.

Last updated

What happens when you choose a file

When you pick a file, your browser lets the page read that one file and nothing else on your device. The tool passes it to a Web Worker, a background thread of the same browser tab, which reads the file in pieces, transforms it and assembles the result in memory. Working in the background keeps the page responsive, even with files of hundreds of thousands of rows.

The result is offered as a download link that points to your browser's memory (an address starting with blob:), not to a server. Saving it writes an ordinary file to your Downloads folder. When you close the tab, the browser frees the memory.

What the server does, and what it doesn't

PrivateCSV is a static website. The server only delivers the pages, scripts and icons that make up the tools, the same files to every visitor. It has no upload feature, no database and no code that could receive or store a file. There are no user accounts, and the site sets no cookies.

Check it yourself in one minute

You don't have to trust this page. Your browser can show you every request:

  1. Open a tool, for example the JSON to CSV converter.
  2. Open the developer tools with F12 (or Ctrl+Shift+I; Cmd+Option+I on a Mac) and select the Network tab.
  3. Choose a file and run the tool.
  4. Look at the list of requests. The first time, you may see the tool's own script being downloaded. You will not see any request that sends your file: no upload, and nothing whose size matches your file.

A second test: use a tool once, then disconnect from the internet or switch on airplane mode, and run it again with another file. It still works, because everything the tool needs is already in your browser.

What this design cannot protect against

Processing files locally removes the server from the picture, but not every risk:

  • Browser extensions can read the pages you visit, including this one. For sensitive files, use a browser profile without extensions or a private window with extensions disabled.
  • Downloaded results are ordinary files. On a shared computer, delete them when you are done.
  • Keep your browser up to date: it is what isolates websites from your files and from each other.

The technology behind the tools

The tools are built with well-known open-source libraries that run entirely in your browser: PapaParse for reading and writing CSV, saxes for streaming XML, and SheetJS Community Edition for Excel workbooks. CSV handling follows RFC 4180, the specification of the format.

Analytics and advertising

PrivateCSV currently uses no analytics and shows no advertising. If that changes, the privacy policy and this page will be updated before it happens. Processing will stay on your device either way.