A passport photo is an unusually sensitive file. It is a clear, front-on, well-lit image of your face, deliberately captured to the standard that biometric matching systems are built around, and it arrives attached to the context of which identity document you are applying for. That combination — a face image plus a document type plus, often, a country — is worth considerably more to a data broker than an ordinary selfie.
Most online passport photo tools work by uploading that file to a server, processing it there and sending a result back. That is not sinister in itself; it is simply how server-side image processing works. But it does mean the file exists, at least briefly, on hardware you do not control, and from that point what happens to it is governed by a privacy policy you have to take on trust: how long it is retained, whether it is used to train models, who the sub-processors are, and what happens to it in a breach.
This tool avoids the question rather than answering it. The photo is never uploaded, because there is nothing on the other end to upload it to.
What actually happens when you use it
- Your browser fetches the page, a stylesheet, a script, and — the first time only — a face-segmentation model compiled to WebAssembly. These are ordinary static files. Nothing about you is in that request beyond what any web request contains.
- You choose a photo. The file is read by the page through the browser's local file API, exactly as it would be by an offline desktop application. It is decoded into an in-memory canvas. No network request is made.
- The segmentation model runs on your device, in your browser's WebAssembly runtime, to separate you from the background. This is the step people assume must be server-side, and it is the reason the download exists: the model runs locally so the pixels do not have to travel.
- The crop, the head-height alignment, the background replacement and the DPI conversion are canvas operations, all local.
- Saving the result is the browser's own download of a file it generated in memory. It does not round-trip through a server.
The practical consequence: after the page and model have loaded once, the tool keeps working with your network connection switched off entirely. That is not a claim you have to believe — it is a test you can run.
How to verify it yourself
Three checks, in increasing order of how conclusive they are. Anyone can run the first two.
| Airplane mode | Load the page, wait for the tool to be ready, then disconnect from the network — airplane mode, Wi-Fi off, or unplug the cable. Now make a photo. It works, start to finish, including background removal. An upload-based service cannot do this. |
|---|---|
| Network tab | Open your browser's developer tools (F12, or Cmd+Option+I on a Mac), select the Network tab, and use the tool with the tab recording. You will see the static files being fetched, and no request carrying your image. Nothing is POSTed. |
| Read the code | Everything that runs is JavaScript and WebAssembly served to your browser in the clear, with no build-time obfuscation. You can read it in the Sources panel. The segmentation runtime is Google's MediaPipe Selfie Segmentation, served from this origin rather than from a third-party CDN, so there is no cross-origin request to a service that could see anything. |
What does leave your device
Being precise about this matters more than the marketing line, so: the page itself is fetched over the internet, and that is a normal web request. It is logged by the host the way any web server logs any request — the request path, a timestamp, an IP address, a user agent. That is unavoidable for anything reachable by URL, and it is disclosed in the privacy policy rather than glossed over.
What does not leave your device:
- The photo. Not the original, not the crop, not a thumbnail, not a hash of it.
- Anything derived from your face. The segmentation mask and the measurements exist only in memory and are discarded when you close the tab.
- Any identifier. There are no accounts, no cookies, no analytics, no third-party scripts and no advertising network. The single item kept on your device is your chosen interface language in local storage, which is a two-letter code.
There is also nothing to delete afterwards, and no retention period to wait out, because no copy was ever created off your device. This is the part that a policy promise cannot match: a service that never receives the file cannot mishandle it, cannot be compelled to hand it over, and cannot lose it in a breach.
When this matters most
- Children's photos. A face image of a minor, attached to a passport application, is a category most parents would rather not hand to an unknown processor. See baby passport photos.
- Immigration and visa applications. The document type reveals your situation — asylum, residence, naturalisation, a specific consulate. That context is often more sensitive than the image.
- Anywhere biometric data is regulated. Under the GDPR, a facial image processed for identification is biometric data in a special category; several U.S. states regulate face templates specifically. Processing that never transmits the image sidesteps a large part of that exposure for you and for the tool alike.
- Poor connectivity. Local processing is also just faster and more reliable: no upload wait on a slow link, no failed round trip, and a large original file costs you nothing in bandwidth.
The one place this tool refuses to help
Local processing is a privacy property, not a licence to edit. The U.S. State Department rejects photos with digitally replaced backgrounds or AI retouching for online passport renewal, and several other authorities — South Korea and Nigeria among them — have similar bans. On those documents the honest answer is that you should photograph yourself against a real wall and leave the background replacement switched off, and the relevant pages say so instead of quietly offering the feature. See why the U.S. bans AI-edited passport photos.
Frequently asked questions
Is my photo uploaded to a server?
No. The file is read locally by the page, processed in your browser — including the face segmentation, which runs as WebAssembly on your device — and saved by your browser from memory. No request carries the image. You can confirm it by opening your browser's Network tab while using the tool, or by disconnecting from the network after the page has loaded and making a photo anyway.
Does it work offline?
Yes, once the page and the segmentation model have loaded. Disconnecting the network after that point does not stop it, background removal included. That is the simplest proof that nothing is being uploaded.
How long is my photo stored, and how do I delete it?
It is never stored anywhere but your own device's memory, and it is gone when you close the tab. There is nothing to delete and no retention period, because no copy is ever made off your device.
What data does the site collect?
Your interface language preference, kept in your browser's local storage as a two-letter code. There are no cookies, no analytics, no third-party scripts and no accounts. The host keeps ordinary web server access logs for the page requests themselves, as any website does; that is stated in the privacy policy.
Is a browser-based tool as accurate as a server-based one?
For the part that determines acceptance — the crop geometry and head height — yes: the same published specification is applied either way, and it is quoted on each document page with a link to the issuing authority. The segmentation model used for background replacement is Google's MediaPipe, the same class of model such services run. What server-side services can add is a human compliance review, which this tool does not claim to offer.
Can I use it on a phone?
Yes. It runs in a mobile browser and processes locally there too, which also means no upload wait on a mobile connection. Older or low-memory devices may take a few seconds longer on the segmentation step.