Are online video converters safe?

Most of them are safe in the narrow sense that they are not trying to infect you. They are unsafe in a duller sense: your video leaves your computer, crosses the internet, and sits on a stranger's disk for hours or days under a policy you did not read. A small number of look-alike sites are genuinely hostile and hand you an installer instead of a video.

Both risks disappear at the same point — when the file is never uploaded. A converter that runs inside your own browser tab has nothing to retain, nothing to leak, and nothing to swap for a malicious download. The rest of this page is how to tell which kind of site you are on, and how to check rather than trust.

The two risks people keep mixing up

"Is this safe?" usually means one of two very different questions, and the answers are not the same.

Risk one: the site attacks you. This is the rare one. It looks like a converter, but the thing you download at the end is not a video. Security researchers and law-enforcement advisories have repeatedly flagged clusters of freshly registered "free converter" domains whose only job is to return an installer, or to nag you into adding a browser extension. These sites buy search ads for exactly the phrase you typed, so a top result is not reassurance.

Risk two: the site behaves normally, and that is the problem. A legitimate upload-based converter has to receive your file, write it to disk, decode it, encode a new one, and hold the result until you collect it. That is not a scandal, it is how servers work. But it means a copy of your video exists somewhere you cannot inspect, next to a log line with your IP address, for however long the vendor's policy says. If the clip is a family video, a doorbell recording, an unaired client edit or anything with a face and a date on it, that copy is the whole question. The published windows differ a lot between vendors — what each converter says it keeps and for how long is worth reading before you pick one.

Red flags that mean close the tab

None of these is proof on its own. Two or more together, and the site is not worth your video.

• The output is not a video. A converted clip arrives as .mp4, .mov, .mkv, .webm or .avi. If you are handed .exe, .msi, .dmg, .scr or a ZIP with one of those inside, the conversion never happened. Windows hides known extensions by default, so holiday.mp4.exe can display as holiday.mp4 — turn on file-name extensions in File Explorer's View menu before you judge.
• You are asked to install anything. A helper app, a "codec pack", a desktop downloader, a browser extension to "speed up conversion". A browser can convert video without any of them. So can the site, if it is real.
• An email wall appears after the upload. Your file is already on their server and now it is hostage to a mailing list. The address you type is the product.
• Several Download buttons, and the big green one is an ad. Reputable pages do not need to disguise their own output. If you cannot tell which button is the file, that ambiguity was designed.
• No privacy policy, or one that never mentions uploaded files. A converter policy that talks only about cookies and analytics is not describing what the service actually does with your data.
• A domain that is a near-miss of a known one, or a page full of testimonials with stock-photo faces and no company name, address or contact route anywhere.
• Push-notification and "allow" prompts before you have done anything. Decline them. They are the delivery channel for the next set of ads.

How a converter site can actually infect you

It is worth being precise, because vague fear leads to bad decisions. Uploading a video does not infect your computer. Watching a page convert does not either. The infection needs you to run something, and there are only a few places that can happen.

The first is the download step, described above: the file you collect is an executable wearing a video's name. The second is malvertising — the converter itself may be honest, but the ad network embedded in the page serves a fake "your download is ready" overlay from somewhere else entirely. The third is the install prompt, where a site claims your file "requires" a small utility. The fourth, and the mildest, is a browser extension that gets permission to read every page you visit for the rest of its life.

Notice what they share: each one asks you to accept something that has nothing to do with converting a video. A conversion that finishes silently, hands you a file with a video extension, and asks nothing else of you is a conversion that behaved.

Verify instead of trusting: three checks anyone can run

Every converter says it respects your privacy. That sentence costs nothing to write. What you can do instead is check the claim yourself, in under a minute, on any site including this one.

Watch the network

Open your browser's developer tools before you pick a file — F12 or Ctrl+Shift+I on Windows, Cmd+Option+I on a Mac — and switch to the Network tab. Now run a conversion. If the file is being uploaded, you will see a request whose sent size is roughly the size of your video, climbing while it transfers. If nothing of the sort appears, nothing of the sort happened. On this site's in-browser converter the only requests are the page and the converter engine itself, both loaded once from this domain.

Turn the network off

The blunter version, and the more convincing one. Run one conversion first — that is when a local converter fetches its engine, once — then disconnect Wi-Fi or switch on aeroplane mode and convert again. A tool that uploads cannot possibly finish. A tool that runs locally will not notice. Our converter is FFmpeg compiled to WebAssembly, running in a worker inside your tab, so once that engine is cached it needs no network at all — you can convert with the router unplugged and the file still lands in your Downloads folder.

Look at what came back

Check the extension, then open the file. If it plays and the duration matches, you have a video. If you want to confirm the container and codec rather than trust the file name, you can read a file's codec in the browser without uploading it anywhere.

When uploading is genuinely fine

Being honest about this makes the rest of the page more useful. Plenty of video does not need protecting. A clip you were about to post publicly anyway, a screen recording of a spreadsheet, a stock file, a meme — send it wherever you like. The established upload-based services are real companies with real policies, and for content you were going to publish, the retention window is irrelevant.

Upload-based services also win on one practical axis: a big server farm re-encodes a two-hour 4K file far faster than a single browser tab can. If that is your job today, the trade is defensible. What matters is that it should be a decision, not a default. The cases where it is worth avoiding are the obvious ones — anything with a child, a face you did not ask, a home interior, a medical or legal document on screen, or client footage you are contractually not allowed to disclose to a third party.

The safer options, in order

Convert in your own browser. The page loads a converter engine and does the work on your machine. There is no account, no queue, no upload. This is also the fastest option for the most common jobs, because when the codec inside your file is already legal in the container you want — MOV to MP4 being the classic case — the streams are copied rather than re-encoded. That takes seconds, and the picture is bit-for-bit identical to the original. The honest limits: files over 2 GB are refused, because a 32-bit WebAssembly heap cannot address them, and a genuine re-encode is single-threaded and slow — roughly real time for 720p, slower for 1080p.

Install a desktop encoder. HandBrake and VLC are long-established, open source, and never touch a network to do their work. They are the right answer for a batch of long files or anything over the browser's size ceiling. The cost is an install and a learning curve, which is exactly why people look for something simpler than HandBrake in the first place.

Use a phone app for phone footage. If the video is already on your handset, the round trip through a computer is wasted effort. Our iPhone converter and Android converter use the device's hardware encoder, which is dramatically faster than any browser on long or 4K clips and has no size ceiling. They always re-encode — there is no stream-copy mode — and on iPhone the first conversion is free with further conversions behind a paid upgrade, while the Android version is unlimited and free.

Whatever you choose, size the tool to the file. If you are only trying to get something under a messaging limit, the constraint is a file size rather than a format, and the WhatsApp size problem has its own answer. If you are weighing a specific upload service, the comparison with an in-browser converter lays out where each one actually wins.

Questions people ask

Can a video file itself contain a virus? In practice, almost never in the way people imagine. Historic attacks abused bugs in media players, and modern players are hardened against them. Keep your player updated and the realistic risk is the download step, not the pixels.

Does HTTPS make an online converter safe? No. The padlock means the transfer is encrypted in transit. It says nothing about what the server does with the file after it arrives, and malicious sites have valid certificates too.

Is a converter with millions of users automatically trustworthy? Scale is evidence of reliability, not of data minimisation. A large service with a clear, short retention policy is a reasonable choice for ordinary video. It is still a copy of your file on someone else's computer, which is the one thing a local conversion never creates.