Is it safe to upload RAW files to an online converter?

You search "convert CR3 to JPG online", the first result has a big drop zone, and thirty seconds later you have a JPG. What you also have is a copy of your client's file on a server you cannot name, under terms you did not read. Sometimes that is fine. Often it is not. Here is what actually happens, and how to tell the safe kind from the other kind in five seconds.

Where the file goes

A conventional online converter is a web page in front of a server. The drop zone uploads your file, the server decodes it, writes a JPG, and hands you a link that expires in an hour or a day. Your 40 megabyte RAW is now on a disk somewhere, has probably been copied to a second disk by the hosting provider's own backup, and will be deleted when a cleanup job runs, or when the operator remembers to. You have no way to check. The upload also costs you: forty frames of a Sony a7R V is two and a half gigabytes, which is a long time on venue wifi and a real bill on a hotspot.

What a RAW carries that a JPEG does not

People hand over a RAW more casually than a JPEG, and it is the more revealing file. It carries the unedited frame, which for a client is the version they did not approve. It carries the full maker's notes: serial numbers of the body and lens, the shutter count on some brands, the firmware, and, if GPS was on, the exact coordinates and time of every frame. On a wedding that is the couple's address at getting ready, the venue, and the route between them. It carries the embedded JPEG, and on a few bodies a second smaller one, so even a service that "only reads metadata" has the picture. A JPEG you export can have all of that stripped. A RAW cannot; the metadata is how it decodes.

What the terms usually say

Read three converter sites' terms and a pattern shows up. A license "to host, store, reproduce and modify" the upload, which is the minimum they need to convert it and is also broad enough to cover anything else. Deletion "within" some hours, unverifiable. A clause that you warrant you have the right to upload the content, which for a wedding you do, and for a client's corporate shoot under NDA you might not. And jurisdiction in a country you did not pick. None of this is sinister; it is boilerplate. It is also a contract about your client's pictures that your client did not sign. If your own contract promises the files stay with you, an upload is a breach you did to yourself in thirty seconds. The AI clause in photography contracts is the same conversation from the other side.

The five second test

Load the page, drop a file, then open your browser's network panel, or simpler, switch the wifi off before you drop it. A converter that uploads will spin and fail. A converter that runs in the browser will work exactly as before, because the decoder is in the tab and the file never left your machine. That is the whole test, and it is worth doing once per tool rather than trusting a "we never store your files" line in the footer.

The other kind of online converter

Browsers can run real decoders now. Kepla's RAW to JPG converter ships LibRaw compiled to WebAssembly and does the whole job in the tab: your files load from disk into the page's memory, the develop runs on your CPU, and the JPG is written to your downloads folder. Nothing is sent anywhere, there is no account, and the wifi off test passes. The EXIF written into the JPG is a clean block, camera, lens, exposure and date, with GPS deliberately left out. It is the same principle Kepla for Mac is built on: the app culls the whole card on your machine, offline, and nothing is uploaded to be culled. Offline culling makes that case; Founding Access is how you get it.

FAQ