A proper editor,
and your picture never leaves.
Open a photo or start from a blank canvas, then work in layers: add pictures, text and shapes, paint, erase, crop, rotate and adjust colour, and export when you are done. The picture is edited in this tab, in memory, and handed back as a download — it is never sent anywhere. Save the layers as a project file to carry on another day.
Or start from a blank canvas
Shortcuts: V move · M select · C crop · B brush · E eraser · T text · U shape · I eyedropper · H or hold Space to pan · [ and ] brush size · Ctrl+Z undo · Ctrl+Shift+Z redo · Ctrl+J duplicate layer · Ctrl+A / Ctrl+D select all / none · Delete removes the selection or the layer · Ctrl+scroll or pinch to zoom · arrow keys nudge. You can also paste a picture, or drop more pictures onto the canvas to add them as layers.
A conventional online converter takes your file, puts it on someone else's disk, does the work there and lets you download the result. Two copies of your file then exist somewhere you cannot see, for as long as that company decides. Here the code that does the work is shipped to your browser instead of your file being shipped to a server: the bytes are read by this tab, transformed in memory, and written back out as a download. Our server never sees them, so there is nothing for us to keep, log or lose.
One thing is counted, and here it is: when a tool finishes, this page tells the server which tool ran and whether it worked — never the file, its name, its size or anything read out of it, none of which ever leaves this tab. It is how we know which tools are worth keeping. The record is the same kind we keep for a one-time link: a truncated IP address, a country and a region.
There is one way to make this server see a file, and it is the API: /tools/api runs these same tools over HTTP for programs, and a call to it does send the file. It is a separate door with its own page saying so — the tool you are reading now does not use it, and nothing on this page uploads anything.
Once the page has loaded, these tools keep working with the network switched off. That is the simplest proof that nothing is being sent anywhere.
Frequently Asked Questions
Q: Is my picture uploaded?
No. The picture is decoded, edited and exported by your browser, in memory. This page has no upload at all, which is why it also keeps working with the network off once it has loaded. The only thing counted is that the tool was used.
Q: What can it do?
Work in layers with opacity, blend modes and drop shadows; add pictures, text and shapes; paint with a brush and an eraser, with rectangle and ellipse selections; crop, resize, rotate and flip; adjust brightness, contrast, saturation, hue, blur and more per layer; and take colours from the picture. Everything can be undone.
Q: Which formats can I open and export?
Anything your browser can display opens — typically JPG, PNG, WebP, GIF (first frame), AVIF and SVG. It exports PNG, JPG and WebP, and AVIF where the browser can write it. JPG has no transparency, so clear areas come out white.
Q: How big a picture can it handle?
Up to 8192 pixels on a side and 50 megapixels in total. A bigger photo is reduced to fit when you open it, and it says so.
Q: How do I keep my layers?
Use Save project: it writes a .hhimg file with every layer, text and setting, which you can open here later. Exporting gives you a flat picture instead. Nothing is kept on the server — close the tab without saving and the work is gone, which is why the page asks first.
Q: Can a program do this too?
The parts that make sense without a screen — crop, rotate, flip, resize, colour adjustments and format — are available as an API and as the hh command (hh image-edit). That is a separate door that does receive the file; its page explains what happens to it.
The same idea, applied to sending things rather than changing them.