How to convert and view 3D files without uploading them to a server

An online converter that runs on a server has a copy of your file the moment you press upload; one that runs in the browser never receives it, and you can prove which kind you are using in about thirty seconds.

Updated 27 October 2026 · 8 min read

What happens when you upload a file

A conventional online converter works like this: the browser sends your file over HTTPS to the operator's server, a program there converts it, the result is written to disk and a download link is returned. HTTPS protects the file in transit. It does nothing about the fact that a third party now holds a copy on hardware you do not control, in a jurisdiction you may not know, subject to logging, backups, crash dumps, staff access and whatever the operator's processing provider does.

For a Thingiverse download this does not matter. For a lot of real work it does:

• Engineering under NDA. A STEP file of a client's housing is confidential information. Most NDAs forbid disclosing it to third parties without written consent; a converter operator is a third party. The fact that the upload was convenient is not a defence.
• Patient data. Intraoral scans, CBCT-derived STLs, surgical guides and prosthetic models are health data. Under GDPR Article 9 they are special category data; under HIPAA they are protected health information when they can be linked to a patient, and a scan of someone's dentition can be. Sending them to a processor requires a lawful basis and, in HIPAA's case, a business associate agreement. A free converter has neither.
• Unreleased products. A GLB of next season's shoe or a 3MF of a product enclosure is exactly what leaks before launch.
• Personal scans. A photogrammetry scan of a face or body is biometric data in several jurisdictions.
• Export-controlled geometry. Some defence and aerospace parts cannot legally be transferred to servers outside specific countries.

What "deleted after 24 hours" really means

Most upload-based services promise deletion after a period. Take the promise at face value and it still leaves a lot open.

• Deletion applies to the primary copy. Backups, replication to a second region, CDN caches of the download link and temporary files created by the conversion program are rarely covered. Object storage providers keep deleted objects in versioning or soft-delete for days to months by default.
• Logs are separate. Access logs record the file name (which is often the part number or patient name), size, your IP address and time. These are typically kept for 30 to 90 days or longer.
• Error handling keeps files. When a conversion crashes, the input is often kept for debugging. Some terms of service say so explicitly.
• Subprocessors. The conversion may run on a cloud function from one vendor, store on another, and serve downloads through a third. Each has its own retention.
• Terms can grant a licence. Read the terms of service. Some grant the operator a licence to use uploaded content to improve the service, which can include training models on your geometry.
• There is no way to verify. You cannot audit a server you do not control. The promise is only as good as the operator's processes and the operator's honesty.

None of this means every service is careless. It means that if the file is one you would not email to a stranger, the retention policy is not a sufficient safeguard, and a compliance officer will say the same.

Processing in the browser instead

A different architecture avoids the problem entirely: the conversion program runs inside your browser, on your machine. The website delivers code, not a service. Your file is opened with the browser's File API, parsed and converted in memory by JavaScript or WebAssembly, and the result is offered as a download generated locally. Nothing leaves the computer.

WebAssembly (Wasm) is what makes heavy formats feasible this way. It is a binary instruction format that browsers execute at close to native speed, and it is how libraries written in C++ for CAD and mesh processing run in a web page. Open CASCADE, the geometry kernel behind FreeCAD, has been compiled to WebAssembly and can read STEP files and tessellate them in the browser. Mesh repair, decimation and boolean libraries have been ported the same way. The practical limits are RAM (a browser tab can usually address 2 to 4 GB) and single-thread performance for operations that are not parallelised; for files up to a few hundred megabytes this is entirely workable on a laptop.

All of the tools on this site work this way. The STEP to STL converter runs the geometry kernel in your browser; the mesh repair tool, the reduce tool and the batch converter do their work in memory on your machine. The STL viewer and STEP viewer render with WebGL from the file object in the tab. Closing the tab removes everything; there is no account and no upload history because there is no upload.

How to verify this yourself

Do not take the site's word for it. Every desktop browser has a network inspector that shows every request a page makes. The check takes under a minute.

Chrome, Edge, Brave

1. Open the converter page.
2. Press F12 (or Ctrl+Shift+I, Cmd+Option+I on Mac) and click the Network tab.
3. Tick Preserve log so entries are not cleared. Optionally click the clear icon to start from an empty list.
4. Drop your file into the tool and run the conversion.
5. Watch the list. On an upload-based service you will see a POST or PUT request whose size (the Size column, or the request payload under the request's Payload tab) matches your file, typically to a path like /upload or /api/convert. On a browser-based tool, nothing new appears while the file is processed, apart from possibly fetching a Wasm module or worker script (a GET of a .wasm or .js file) before the first run.
6. For a stricter test, open the Network conditions panel (three-dot menu in DevTools, More tools > Network conditions) or use the Offline preset in the throttling dropdown after the page has loaded, then run the conversion again. A browser-based tool keeps working offline; an upload-based one fails.

Firefox

Press F12, choose Network, tick Persist Logs. The same POST test applies. Firefox also shows the request body under the Request tab of each entry.

Safari

Enable the Develop menu under Settings > Advanced > Show features for web developers, then Develop > Show Web Inspector and open the Network tab.

What to look for

• Filter by Fetch/XHR to hide images and fonts. Uploads are almost always XHR or fetch requests.
• Sort by size. An upload of a 40 MB STL is the largest request on the page by far.
• Check WebSocket connections too (the WS filter); a few services stream file data that way.
• Analytics requests (to a measurement endpoint) are a few hundred bytes and do not contain the file. They are not an upload, but if you want none at all, a content blocker will stop them.
• A download at the end is generated locally when its URL begins with blob:. A download from a server URL means the result was fetched from somewhere, which implies the input went there.

The offline test is the definitive one. If the tool converts a file with the network disabled, the file cannot have gone anywhere.

Other options that keep files local

Browser-based tools are not the only route. Desktop software never uploads anything unless it has a cloud feature switched on.

• FreeCAD (free, Windows/Mac/Linux): imports STEP, IGES, STL, OBJ; exports STL, 3MF, OBJ. Mesh workbench handles basic repair.
• Blender (free): imports STL, OBJ, FBX, GLB, PLY; exports the same plus USDZ via the USD exporter.
• MeshLab (free): the widest mesh format coverage and the best decimation and cleaning filters.
• PrusaSlicer, Bambu Studio, Cura: import STL, OBJ, 3MF, STEP (PrusaSlicer 2.6+, Bambu, Orca) and export STL and 3MF; a perfectly good STEP-to-STL converter if you already have one installed.
• Fusion 360, Onshape: note that these are cloud products. Onshape stores every document on its servers; Fusion 360 syncs to Autodesk's cloud by default. Both have terms that cover confidentiality, and both are used under NDA routinely, but they are not local tools.

Desktop tools win on very large files (multi-gigabyte scans) and on operations that need hours of CPU time. Browser tools win on not having to install anything, on working from a locked-down corporate machine where installs are blocked, and on running identically on any operating system.

A note on the dental and medical case

Intraoral scanners export STL or PLY, and labs routinely need to convert, trim, hollow or merge them. If the file name or any embedded metadata identifies a patient, treating it as PHI or special category data is the correct default. Processing it in the browser on a clinic or lab computer keeps it within the same security boundary as the scanner software; sending it to an external converter does not. The intraoral scan file guide covers the formats involved and the resin calculator handles model costing without any file leaving the machine.

FAQ

Is it safe to upload STEP files to online converters?

Only if the file is not confidential. Under an NDA, uploading to a third-party server is usually a disclosure. Use a converter that processes the file in your browser, or desktop software, and verify with the DevTools network tab.

How can I tell if a website uploads my file?

Open DevTools (F12), go to the Network tab, run the conversion and look for a POST or PUT request the size of your file. Or switch the browser to offline mode after the page loads and run the conversion again; a local tool still works.

What does WebAssembly have to do with file conversion?

WebAssembly lets compiled C++ libraries such as CAD kernels and mesh processors run inside the browser at near-native speed, which is what makes STEP parsing and mesh repair possible without a server.

Can I convert patient scans online under HIPAA or GDPR?

Not through an upload-based service without a business associate agreement or data processing agreement. A browser-based tool that never transmits the file does not create a processor relationship, because no data is transferred.

Are browser-based converters slower?

For files under a few hundred megabytes the difference is small; a STEP of a few thousand faces tessellates in seconds. Very large scans and long operations are better in desktop software, which has more memory and uses all CPU cores.