October 3, 2026 · 7 min read

You Just Uploaded Your Passport to a Site You Don't Know

A passport scan is a whole identity in one file. Here is what happens when you drop it into a random website, and the 60-second test that settles it.

The visa form wants your passport scan under 2 MB. Yours is 8. You search, you find a free tool, you drag the file in. Thirty seconds later you have what you needed and the tab is closed. You have also just handed a stranger your full name, date of birth, nationality, document number and signature, in one file, and you have no idea where it is now.

This is not a lecture about never using free tools. It is about knowing which kind you just used, which takes less than a minute to find out.

There are only two kinds of tool

Upload-based is not sinister. Plenty of upload tools are run by serious companies, and some jobs cannot be done any other way. But the structure is what it is: a copy of your passport now exists on a computer you do not control, for a period described in a document you did not read. If that company is breached, acquired, or just careless with backups, your document is in the pile.

Browser-based has no pile. There is no copy to leak, because no copy was made.

Why an ID is worse to lose than almost anything else

• It is a complete identity package: name, date of birth, document number, nationality, often an address and a signature.
• You cannot rotate it. A leaked password takes a minute to change. A date of birth is yours forever, and a new passport takes weeks and money.
• It is precisely what identity-verification and account-recovery flows ask for. That makes it directly useful to someone pretending to be you.
• It gets resold. Documents from one breach circulate in bundles for years.
• The scan snitches too: scanner or phone model, the date, and GPS if you photographed it instead of scanning it.

Ask these before the file goes in

• Does the site say plainly whether files are uploaded? "Secure" and "private" are adjectives. "Processed in your browser, never uploaded" is a claim you can test.
• If they do upload, how long do they keep it? "One hour" is a commitment. "As long as necessary" is not.
• Who are they? A named company with a jurisdiction and a contact address can be held to its policy. An anonymous site cannot.
• Is there a privacy policy, and does it match the homepage? Contradictions tell you more than either page alone.
• Are they asking you to sign up? An account staples your passport to an email address and a payment profile. For a one-off resize, that is a terrible trade.

The dare: pull the plug and watch

Do not take anyone's word for this. Ours included. A tool that genuinely runs in your browser has one property nobody can fake: it keeps working with the internet switched off.

• Load the page. Let it finish completely.
• Kill the network. Wi-fi off, cable out. Properly off.
• Now use the tool. Drop a file in and run it.
• Result appears? It was computed on your device. There was nowhere else for it to go.
• Hangs or errors? Your file was being shipped somewhere.

Prefer looking under the bonnet? Open developer tools, go to the Network tab, clear it, run the tool. You are hunting for one thing: an outgoing request the size of your file. A local tool produces nothing of the sort — just its own scripts, fonts, and any model it downloads once. Try it on a throwaway image first so you learn what normal looks like.

This works on any site on the internet. It is the most useful thing in this article.

Where Skrubly stands, exactly

The metadata cleaner, file compressor, background remover, AI text detector and AI image checker run entirely inside your browser tab. The code loads once and then works on the file sitting on your own disk. Your documents are never uploaded, never stored on a server, never seen by us. No account. No sign-up. No watermark. Switch off your wi-fi and they all keep running — please go and check.

One tool is not local and we are not going to hide it. The TikTok downloader sends the link you paste to our server, which asks a third-party provider to locate the video, and the video is fetched server-side. A public URL travels; your own files never do.

And the rest of it: the site is ad-supported, it uses cookies and aggregate analytics, and it processes routine technical data such as IP address, browser and pages visited, as the privacy policy sets out. We are not claiming to collect nothing. The claim is narrower and checkable — your files are not part of it.

The routine for document scans

• Work from a copy. Move it off the camera roll into a folder you control.
• Crop to the document. The kitchen table and the other paperwork in frame are free information for nobody's benefit.
• Strip the metadata, so you are not also handing over when and where you scanned it.
• Compress to just under the limit, not to the smallest file possible. An unreadable ID gets the application bounced.
• Send through the official portal, not email, where it lives in two mailboxes forever.
• Delete the working copies when it is done. Name anything you keep for its purpose and date.