How to prove TableMender does not upload your CSV

Use browser DevTools to verify conversion stays local and distinguish hosting requests from uploads.

What “no upload” means on this site

TableMender’s converters read your CSV in the browser, preview it in the page and build a downloadable file on your device. There is no file-upload API for tool contents. That claim is stronger when you can verify it yourself with ordinary browser developer tools. This guide shows a practical check. It does not change the tool shell, inject network monitors or ask you to install extensions.

Ordinary page loads still contact Cloudflare for HTML, CSS, JavaScript and optional Web Analytics. Those requests are not your spreadsheet. The distinction matters: hosting traffic is expected; your CSV payload should not appear as an upload body.

A tiny file is enough for the check

You do not need a production export. Any short synthetic CSV works. The sample below matches the leading-zeros teaching file already on the site:

product_id,postal_code,reference,quantity
00127,02108,12345678901234567,12
00904,00501,98765432109876543,3

Download the same bytes from /samples/leading-zeros.csv, or load it from the tool’s problem sample pack. If those identifiers appear in a Network request body during preview or download, treat that as a failed check and stop before using real data.

Prove it with DevTools in a few minutes

1. Open CSV to Excel in Chrome, Edge, Firefox or Safari.
2. Open Developer Tools. Select the Network panel. Enable Preserve log. Clear existing entries.
3. Filter to Fetch/XHR (and watch Doc/Other if you prefer a full picture).
4. Load the teaching sample or paste a few synthetic rows. Click Preview, then Download.
5. Inspect the Network list. You should not see a multipart upload or a POST whose request body contains your CSV fields. New requests, if any, should be ordinary static assets or privacy-oriented analytics beacons without your table contents.

Open the converter and run the check →

Before and after: what “good” and “bad” look like

Expected (pass). After preview and download you may see GETs for /assets/app.js, styles, fonts and possibly a Cloudflare insights beacon to static.cloudflareinsights.com or cloudflareinsights.com. Request bodies should not contain 00127, 02108 or other fields from your paste.

Unexpected (fail). A POST or PUT to an unfamiliar path whose payload includes your rows, a multipart form with your filename, or a websocket that streams the table. Stop, keep a HAR for your own records, and contact the operator with a synthetic example only.

How to read what you see

A request to the TableMender origin for /assets/ scripts or styles is normal. Loading /samples/*.csv from the sample pack is also a GET of a public teaching file — that is not an upload of your private export. A Cloudflare insights beacon may appear when Web Analytics is enabled; it measures page performance and is not a file conversion upload—see the privacy policy. If you paste secrets into a CSV, treat the screen as sensitive regardless of network results: shoulder surfing and browser extensions are outside this tool’s control.

Step-by-step troubleshooting

1. Many requests appear after Preview. Sort by type. Ignore images and stylesheets. Focus on POST/PUT and large request bodies.
2. You see cloudflareinsights.com. That matches the documented Web Analytics beacon. Open the request and confirm your CSV fields are absent.
3. Corporate proxy logs TLS destinations. Metadata that a page was visited is an environment control, not TableMender receiving the file contents.
4. You used a browser extension that “syncs” forms. Disable it for the check; extensions can send data independently of this site.

Honest limits

DevTools proves what this page’s JavaScript requested in that session. It does not audit Cloudflare’s edge logs, your ISP or every extension. Memory dumps and screenshots can still expose pasted data. The tools still process only what you load locally; they do not claim anonymity for visiting the website. For product behavior limits, read the FAQ.

When the check disagrees with your expectation

If you see an unexpected POST that clearly includes your rows, stop and keep a HAR export for your own records, then contact contact@tablemender.app via the contact page with a synthetic example—never with real customer files. Matching tools: CSV to Excel, CSV clean, CSV check & repair. Related guide: leading zeros.

How to save evidence without sending the file

Chrome, Edge and Firefox can export a HAR from the Network panel (right-click the request list). A HAR is a log of URLs, headers and bodies for that session. Redact it before sharing: search the HAR for 00127 or any other teaching field you pasted. If those strings appear only in the page HTML you loaded, not in a request payload, the conversion itself did not upload the table. If they appear in a POST body, stop.

Safari’s Network tab labels types differently; look at method and request payload rather than at the “XHR” filter name. A service worker, password manager or “form sync” extension can send data that TableMender’s JavaScript never requested. Repeat the check in a clean profile if the first pass is noisy. Content-Security-Policy on this site allows connect-src only for Cloudflare Web Analytics; a conversion upload to an unknown host would violate that policy in a supporting browser, but CSP is not a substitute for reading the Network list.

What this check does not prove

DevTools shows what this document’s scripts requested in that tab. It does not audit Cloudflare edge logs, your corporate TLS inspector, or every extension. Screenshots, shoulder surfing and memory dumps can still expose pasted rows. Closing the tab releases the tool’s JavaScript references; it is not a cryptographic erase. The privacy policy states those limits in more detail. The testing section describes repository checks; those checks also do not watch your browser.

FAQ grounded in the converter

I loaded a public sample from /samples/. Is that an upload of my data? No. That GET fetches a published teaching file. Your private CSV is the file you choose or paste.

The insights beacon fired during Preview. Confirm the request body does not contain your rows. The beacon is documented Web Analytics, not AdSense, and is not a conversion API.

Can I skip DevTools and trust the copy on the page? You can, but then you have not proved the claim. This guide exists so the “no upload” sentence is checkable.

Worked preview of leading-zeros.csv

Load leading-zeros.csv in CSV to Excel with Comma and a header, or choose “Leading zeros” in the sample pack. Preview should show 2 data records and 4 columns, with 00127, 02108 and the full 17-digit reference intact. That is the same teaching file used on the leading-zeros guide. If those identifiers appear in a request payload during Preview or Download, the check has failed.

After Preview, with every column on Text, preflight warns: leading zeros in columns 1 and 2 (4 cells) and 16+ digit tokens in column 3 (2 cells). The how-to link on that row opens long digit IDs because of the 17-digit reference. The warning text still names the zeros. Number on product_id or postal_code is blocked by leading zeros; Number on reference is blocked by more than 15 significant digits; Number on quantity reports 2 numeric cells and allows download. Those results run in this tab. They are not a server round-trip.

The XLSX and the optional preflight CSV are built as local blob downloads. They use a -converted or -preflight suffix so they do not replace the source file. Blob URLs do not appear as POSTs in the Network list. CSV clean and CSV check & repair use the same in-tab parser; repeat the check on those pages if that is the tool you will actually use.

CSP, beacons and what a supporting browser blocks

This site’s Content-Security-Policy allows connect-src only for Cloudflare Web Analytics. A conversion upload to an unknown host would violate that policy in a supporting browser. CSP is a backstop, not a substitute for reading the Network list, and it does not stop a browser extension that injects its own requests. Repeat the check in a clean profile if a password manager or “form sync” add-on is noisy.

Search a HAR export for 00127 before you share it. If those digits appear only in the HTML you loaded, the conversion did not upload the table. If they appear in a POST body, stop. Email contact@tablemender.app via the contact page with a synthetic example — never with a customer extract. Matching tools: CSV to Excel, CSV clean, CSV check & repair.

← All guides