Static WorksINDEPENDENT WEB NOTES
Browser Technology / ARTICLE

Files Stay Here: The Boundaries of Local-First Browser Tools

What Canvas, Web Workers, and IndexedDB can do—and how to make local processing a verifiable privacy claim.

Published 3 min read

“Your files never leave this device” is one of the strongest promises a web tool can make. It avoids an upload delay and keeps passports, contracts, and personal photographs away from an unfamiliar server. But interface copy alone does not create privacy. The implementation, third-party scripts, and error handling must support the claim.

The browser is a runtime

Modern browsers can read files that a user explicitly selects, decode and re-encode images with Canvas, calculate digests through Web Crypto, run expensive work in a Web Worker, and keep temporary state in IndexedDB.

An image compressor can remain entirely on the device:

  1. The user grants access through a file picker.
  2. The browser decodes the image into a bitmap.
  3. Canvas redraws it at the target dimensions.
  4. The browser encodes JPEG, PNG, or WebP output.
  5. An object URL provides the download.

The original file never needs to be submitted to an application server. The Network panel should make that fact easy to verify.

Move heavy work off the main thread

The most common failure in local file processing is a frozen interface. JavaScript normally shares the main thread with rendering; a multi-second loop prevents click feedback and progress updates.

A Web Worker creates a useful boundary: the main thread owns the interface and messages, while the worker owns computation. Large binary buffers should be transferred rather than copied.

worker.postMessage({ buffer }, [buffer]);

worker.onmessage = ({ data }) => {
  renderResult(data);
};

Progress should correspond to real stages. For a task that finishes in a few hundred milliseconds, an honest busy state is better than a decorative percentage.

Local processing has limits

Available memory depends on the device. A 30 MB compressed image may expand into hundreds of megabytes of pixel data. Mobile browsers are especially likely to terminate a tab under memory pressure. A responsible tool checks dimensions and file size early, then states its limits before processing begins.

Format support also varies. Canvas handles common JPEG, PNG, and WebP paths well. Complex PDF manipulation, professional image formats, and video transcoding often call for WebAssembly. That introduces another budget: module download size, initialization time, and peak memory.

Tasks that are usually poor pure-frontend candidates include protected API credentials, dependable cross-device storage, bypassing another site’s CORS policy, files larger than ordinary device memory, and results that require a trusted server signature.

Audit the promise

The absence of an upload API does not guarantee that user data stays private. Error monitoring, analytics, or advertising code may collect page details. A file name or generated result placed in a URL can end up in request logs.

Before release:

  • inspect every network request during processing;
  • keep user content out of analytics and error events;
  • revoke object URLs after use;
  • explain how long temporary data is retained;
  • minimize third-party scripts and document them;
  • report the error without attaching the original content.

Privacy is not product copy. It is a chain of decisions that can be inspected from interaction design through dependencies.

A strong local-first tool can often keep working after the network disappears. When that is true, privacy, speed, and resilience tend to improve together.

END