Search for a HEIC converter and you will find dozens. Open your browser’s network tab while using almost any of them and you will watch your photograph upload.
That is not laziness. It is the path of least resistance for a real technical constraint — and worth understanding, because the alternative exists and almost nobody takes it.
Why the upload happens
Browsers decode JPG, PNG, GIF, WebP and AVIF natively. The decoders are built in, so a web page can hand a file to the browser and get pixels back with no extra code.
HEIC is the significant exception. Apple adopted it as the iPhone default in iOS 11, but no
browser ships a HEIC decoder — partly a patent-licensing question around HEVC, the codec inside
it. So a web page handed a .heic file simply cannot read it.
Faced with that, there are two options. Send the file to a server with the codec installed, which is roughly twenty lines of work. Or compile a decoder to WebAssembly and ship it to the browser, which is more effort and about 1.5 MB of download.
Nearly everyone picks the first.
Why it matters more for HEIC than other formats
Think about which files are actually HEIC. Not stock imagery or design assets — camera roll. Photos of family and children. Photos of your home. Documents, receipts, passports and forms photographed because it was faster than scanning. Screenshots of private conversations.
Then consider what travels alongside the pixels. HEIC files carry EXIF, and iPhone EXIF routinely includes GPS coordinates accurate to a few metres, the exact timestamp, and the device identifier. Upload a holiday photo to an unknown converter and you have handed over the picture and the location it was taken.
Most of these sites are fine. They will process your file, hand it back and delete it on schedule. But “probably fine” is a different proposition from “structurally cannot happen”, and you have no way to tell which site you are on from the outside.
How to check any of them
Open developer tools, switch to the Network tab, and convert something. If a large upload appears, your photo was sent. If nothing moves, it was not.
Five seconds, and it tells you what the software does rather than what its privacy page claims.
The other option
Our HEIC converter takes the second path: a WebAssembly build of libheif
runs inside your browser. The photo is decoded on your own machine and never transmitted.
The honest trade is a ~1.5 MB download the first time you use it, cached afterwards. That is the cost of the decoder living on your device instead of ours — and for photographs that may carry your home coordinates, it seems a fair one.
One side effect worth knowing: because the image is decoded to pixels and re-encoded, EXIF is not carried across. Your GPS coordinates do not survive the conversion. When posting photos publicly that is usually exactly what you want, but if you need the metadata kept, convert with something that preserves it.
The general rule
When a web tool handles something sensitive, the question is not whether the operator is trustworthy. It is whether the design requires you to trust them at all.