Verify your SVG stays on this device
You do not have to take our word for local processing. This page shows how to check it and explains the safety model for untrusted SVG files.
Check the Network panel
- Open the converter, then DevTools → Network, and tick Preserve log.
- Reload. Expected requests: the HTML page,
/assets/styles.css,/assets/tool.jsand/favicon.svg, all GET from this site. - Drop an SVG and press Convert. New rows should be only
blob:URLs (the image being rendered and the PNG preview). No POST or PUT, and nothing to another host.
The response headers include a Content-Security-Policy with connect-src 'none', script-src 'self' and form-action 'none': the page's own scripts cannot send fetch/XHR/beacon requests, no third-party script can load, and there is no form to submit.
How untrusted SVG is handled
- The SVG text is never inserted into this page's HTML. It is only loaded into an
<img>from ablob:URL. - In that image mode browsers do not run
<script>or event handlers inside the SVG and do not fetch external fonts, images or stylesheets. - Files with
<!ENTITYdeclarations are refused, to avoid "billion laughs" entity expansion. - Output size is capped (16384 px per side, 64 megapixels) so a file claiming enormous dimensions gets an error instead of exhausting memory.
- Download names are cleaned of path and control characters and limited to 120 characters.
What this does not cover
Local processing keeps your file away from our servers. It does not protect against browser extensions or other software on your own device that can read tab contents.
FAQ
Can a malicious SVG run JavaScript on this page?
Not through the converter. The SVG is rendered only as an image, where browsers disable scripts, and its markup is never added to the page DOM. The page CSP also allows scripts only from this site.
Can an SVG make my browser contact another server?
Not while rendered here. SVG used as an image cannot load external resources, so tracking pixels or remote fonts referenced in the file are not requested.
Is the PNG stored anywhere?
Only in your tab's memory as a blob URL until you clear, reload or close the tab, and in your downloads folder if you save it.
Does the site use cookies or analytics?
No cookies, no analytics script and no ad code are included. The privacy page will be updated before that changes.
What happens with a huge or broken SVG?
Oversized output, files over 10 MiB, files with entity declarations, and markup the browser cannot render all produce an error message for that file. Other files in the batch still convert.
Does this site claim a security certification?
No. The repository keeps an internal security self-check, but the site holds no formal certification.