Privacy and security
Transcribe audio without uploading it anywhere
The page reads your file and writes the transcript inside your browser tab. The site has no way to receive the file: there is no upload endpoint, and the page may connect only to this site. Below is what your browser downloads, what it keeps, what the host still sees, and how to check it yourself.
- The audio or video file you add
- The sound the page reads from it
- The language you choose
- The transcript and what you search for in it
- The audio or video
- Its file name
- Its metadata, such as the recording date or location
- The transcript made from it
- Your searches in the transcript
- The text you copy and the TXT files you save
Where the transcription happens
The transcription engine, the part that turns speech into text, runs inside your browser tab. It is a WebAssembly program and an open-source speech recognition model, both downloaded from this site the first time you add a file. Inside the tab, the page reads your file's sound and hands it to the engine a slice at a time; the transcript is written into the page. Neither your file nor the transcript made from it goes back to the site. How the transcription runs in your browser explains each step.
What your browser downloads, and nothing else
Opening the transcription tool downloads the page itself, its styles, its scripts, and a few images, all from this site. When you add your first file, the page also downloads, from this site, one build of the engine, the media reader (about 0.3 MB), the model you picked (about 60 MB for the smaller one or about 265 MB for the larger one, in parts), and a voice detector of under 1 MB that finds the stretches with speech. The engine build is a CPU one (about 1.5 MB), or the WebGPU build (about 3.4 MB) in its place when your browser offers a usable WebGPU adapter and that build starts with a GPU device; if the WebGPU build registers no GPU device, fails to start, or fails during a run, a CPU build downloads as well. Where the file can be read in slices, the media reader reads it a slice at a time, decoding compressed sound with your browser's own decoder and uncompressed sound, as in a WAV file, itself; otherwise the page decodes the whole file with your browser, without it. There are no fonts or scripts from other sites, no analytics, and no ads.
What stays in your browser afterwards
The model and the voice detector. When the browser has room for them, the page keeps their verified parts in your browser's Cache Storage for this site, with a small note for each that all its parts are saved, so later files and visits skip the download. The browser may clear them to free space, and your next file then downloads them again. They hold only the model and the voice detector, never your recordings or transcripts. To remove them, clear this site's data in your browser; the next file then downloads the model again. Like the page's other files, the engine may also sit in your browser's ordinary cache. The transcript lives only in the open tab, and the browser discards it when you close the tab. Apart from those parts, the page's scripts store nothing: no cookies, no localStorage or sessionStorage, and no IndexedDB.
The page can read only the file you give it
You hand the page a file by choosing it or dropping it on the drop area. A web page cannot browse your folders: the browser gives it the one file you picked and nothing else. The page checks that the file is an audio or video file and refuses anything else with a message.
What the browser enforces
The site sends security headers with every page, and your browser enforces them no matter what the page's scripts try to do. In plain language:
| Header | What it does |
|---|---|
Content-Security-Policy: connect-src 'self' | The page's scripts may connect only to this site. The browser blocks a request to any other server. |
Content-Security-Policy: form-action 'self' | A form on the page can submit only to this site. |
Content-Security-Policy: script-src 'self' 'wasm-unsafe-eval' | Only scripts served by this site run. The second value lets the browser compile WebAssembly, the format the transcription engine is built in. |
Content-Security-Policy: media-src 'none' | The page cannot play audio or video from anywhere. It does not need to: it reads your file's contents instead of playing it. |
Permissions-Policy: camera=(), microphone=(), geolocation=() | The camera, the microphone, and location are switched off for the page. It cannot even ask for them: the tool takes files, never live sound. |
Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY | No other site can show this page inside a frame, which blocks clickjacking (a fake page laid over the real one). |
Content-Security-Policy: worker-src 'self' blob: | The workers that read your file and run the engine may start only from this site's scripts or from inside the tab. |
Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy | They isolate the tab from other sites. Browsers require this isolation before a page may share memory between threads, which the engine's multi-threaded build uses. |
Behind the headers, the site is a set of static files on a content delivery network. No server program of ours runs behind it, so there is no endpoint that could accept a file even if the page tried to send one.
Check it yourself
Your browser's developer tools list every request a page makes, so you can check this on your own computer (Chrome's Network panel guide explains the panel):
- Open the transcription tool on a computer and press F12 (or Cmd+Option+I on a Mac) to open developer tools, then choose the Network tab. In Safari, first turn on the developer features in Settings, Advanced.
- Reload the page. You should see the page, its styles, scripts, and images, all from transcribe-audio.online.
- Add an audio or video file. The first time, new rows appear for the engine, the media reader, the parts of the model, and the voice detector, all from transcribe-audio.online. On a later visit, if your browser had room to keep them, the model's parts come from its storage, so only a few small files that list them are requested again.
- Check the Method column (if it is hidden, right-click a column header to show it). Every row should read GET or HEAD, and every address should be transcribe-audio.online. Rows starting with blob: or data: are links inside your tab, not network transfers.
An upload looks different: a request with the POST or PUT method whose size is about the size of your file, often to another domain. If you ever see one when you add a file here, something is wrong, and we want to hear about it at support@transcribe-audio.online.
What our automated test checks
An automated browser test loads a built copy of the site in Chromium, the engine behind Chrome and Edge, and adds a file. Every change to the site runs it. Among its checks:
- Every request of the session goes to this site as a GET or HEAD request with no body, and no request address holds the name of a file the page was given. A request to another server, with another method, or with a body fails the test.
- Opening the page downloads no engine, no model, and no worker: they come from this site only once you add a file.
- Sample recordings are transcribed inside the tab: a WAV file, an MP4 video (H.264 and AAC), and a WebM file with Opus sound, each read in slices, and each transcript is at most two words off the expected sentence.
- The copied text and the downloaded TXT file hold exactly the paragraphs the page shows, with and without timestamps.
- Cancel stops a transcription, and the next file uses the model the browser already keeps, with no model part downloaded again.
- The site is served with its production headers, and the browser reports no Content-Security-Policy violation.
What "no upload" does not cover
- The host sees ordinary requests. Like any website's host, the hosting and delivery provider processes standard request data, such as your IP address and browser details, to serve the files and protect the site. From the model files your browser asks for, it can tell which model you picked. Those requests contain nothing from your file.
- The page needs a connection to load. There is no offline mode.
- Extensions can see the page. What an extension sees, and how to keep a recording away from one, is under Privacy questions below.
- Downloads are ordinary files. Once you save a transcript, it follows your device's rules: a synced folder, a backup, or an email attachment takes it wherever those go. Text you copy goes to your clipboard, which some systems sync to your other devices.
- Your device is your own. Malware, or other people with access to your computer, are outside what any web page can control.
Privacy questions
How do I remove what the site stored?
Clear this site's data in your browser. That deletes the saved parts of the model and the voice detector, with the small notes that mark them complete: the only things the page stores. In Chrome or Edge, open developer tools, then Application, Storage, and Clear site data (Chrome's guide); Firefox explains it in clear cookies and site data. Your next file downloads the model again.
Can I use it for a confidential recording?
The recording and the transcript never reach us, so we cannot see, keep, or lose them. Whether a tool fits your own rules, for a client, a patient, or an employer, is a decision we cannot make for you; the facts on this page are what you can check.
Can a browser extension see my recording?
It can if you allowed it to read and change the pages you visit. Such an extension sees what this page shows, the transcript included, and no web page can stop that. For a sensitive recording, use a browser profile with no extensions installed.
Transcribe a recording
Nothing you add leaves your device. Watch the requests while it runs, if you like.