Why a government ID is a special category of image
An ID card or passport can reveal a full name, document number, date of birth, portrait and other identifying fields. Exposure can lead to privacy risks and attempted impersonation. A file used for a simple crop or resize should not automatically be treated as a harmless photograph. If a service does not require an ID image, do not supply one merely to test it.
Local processing helps, but needs verification
A browser tool may read a selected file in memory and process it entirely on the device. That can reduce the chance of the image leaving the device, but it is not guaranteed by a marketing label or HTTPS alone. External libraries, logging, analytics, browser extensions and page changes are additional considerations. Review the privacy policy and use a service you trust for sensitive material.
How to inspect network activity with a harmless test file
Use a deliberately fabricated sample image, never a real ID, for verification. Open browser developer tools, select the Network tab, enable Preserve log, clear existing requests, and then process the sample. Filter for Fetch/XHR and inspect uploads, multipart form data, request destinations and response status. Also inspect all request types because file content can travel through other mechanisms. Seeing no file upload during this test does not prove every code path or future version will behave the same way.
Check what the browser actually sends
Network panels can show script loads, analytics calls, font requests and other ordinary traffic that is not an ID upload. Separate those from requests containing the chosen image bytes. A request to a different origin deserves attention but is not automatically proof that personal file contents were sent. If you cannot confidently verify the workflow, use an offline editor or an approved secure provider instead.
Minimize exposure from the start
Only provide an ID when a legitimate workflow requires it. Follow the receiving organization's requirements: cropping or hiding a field may make a document invalid for identity verification, so do not alter a required image without permission. Where permitted, avoid sending unrelated information. Be careful with filenames, screenshots, cloud backups and shared folders as well as the image itself.
Secure the exported result and source
Keep the original in a trusted location with access controls. Remove temporary copies from public or shared directories and avoid sending government IDs through unrelated upload forms. Do not assume a downloaded processed copy has had identifying metadata removed. A metadata inspector and visible-content review can help, but cannot replace the security policies of the organization that requested the document.
A
T
o
I
n
R
e
Try the workflow
Start with a non-sensitive sample, preserve the original and compare the output before using it.
Open relevant tool ↗