Your Image Compressor Is Uploading Your Photos — Does It Matter?
You drag a photo into an online compressor, wait a few seconds, download the smaller version, and move on. Simple enough. But in those few seconds, your original photo travelled to a server you do not control, was processed by software you cannot inspect, and was stored — at least temporarily — on infrastructure you know nothing about.
How most image compressors work
The majority of online image compression tools — TinyPNG, iLoveIMG, Compressor.io, and dozens of others — follow the same architecture. Your browser uploads the full image to a remote server. The server processes it using compression algorithms. The server sends back the compressed version. You download it.
This means your original, uncompressed photo passes through a third party. For a landscape photo or a stock image, this is harmless. But people compress all kinds of images: identity documents, passport photos for government applications, medical records, legal documents, personal photos, and business materials.
What your photos reveal
Beyond the visible content, every photo from a smartphone carries EXIF metadata — an invisible payload of information embedded in the file. A typical phone photo contains your GPS coordinates at the time of capture, precise to a few metres. It includes your device make and model, the operating system version, the exact date and time, and camera settings.
When you upload a photo to a compression service, this metadata travels with it. Even if the service promises to delete your files after processing, the metadata has already been transmitted. Someone with access to the server — whether an employee, a data breach, or a government request — could extract your location history, device fingerprint, and activity patterns from your photos.
The fine print
Most image compression services state that uploaded files are deleted after a short period — usually between one hour and 24 hours. Some services are transparent about this, others bury it in their privacy policies.
What the policies typically do not say is how the files are stored during processing, whether backups or logs retain references to uploaded content, whether data is processed in the same jurisdiction as the user, or what happens in the event of a data breach.
This is not necessarily malicious. Running image compression servers is expensive, and most of these services operate honestly. But the architecture itself introduces a risk that does not need to exist.
The alternative: client-side processing
Modern browsers are powerful enough to compress, convert, and resize images without any server involvement. The Canvas API, built into every modern browser, can decode and re-encode images in JPEG, PNG, and WebP formats. The FileReader API can read files from your device. The Blob API can create downloadable outputs. No upload required.
This is how MiniPx works. When you select an image, JavaScript reads it from your device, processes it in your browser's memory, and creates a compressed version you can download. At no point does the image leave your device. You can verify this by opening your browser's developer tools and watching the Network tab — no image data is transmitted.
You can even disconnect from the internet entirely and use MiniPx. It still works, because there is no server to communicate with.
What about compression quality?
A common assumption is that server-side compression must be better because servers have more processing power. In practice, the compression algorithms are the same. The browser's Canvas API uses the same JPEG and PNG encoding standards as server-side libraries. For WebP, browsers use Google's own libwebp implementation — the same library that server-side tools use.
The results are comparable. In some cases, specialised server-side tools like MozJPEG or pngquant can squeeze out a few percentage points of additional compression. But for most real-world use — website optimization, email attachments, document uploads — the difference is negligible and does not justify the privacy trade-off.
Protecting your metadata
Even if you do not care about the compression server seeing your photos, you should care about EXIF metadata. If you are sharing compressed images via email, messaging, or direct download, the metadata often survives intact. Anyone who receives the file can extract your location, device, and timestamps.
MiniPx strips EXIF metadata automatically during compression. There is also a dedicated EXIF removal tool if you want to clean metadata without compressing. Both run entirely in your browser.
Does it matter?
For casual use — compressing a meme or resizing a stock photo — probably not. The risk from a reputable service like TinyPNG is low, and the convenience is real.
But if you are compressing identity documents, passport photos, medical images, legal documents, personal photos you would not want public, or business materials under NDA — the question changes. When a client-side tool gives you the same result without any of the risk, there is no reason to accept the trade-off.
Frequently asked questions
Compress, convert, and resize images in your browser. Nothing gets uploaded.
Open MiniPx →