Security

What the product is built to do — and what it cannot promise

ImageTo100.com is a static site. The compressor is designed so the photo never needs to reach our origin for encoding. That is the main security choice. It is not a claim that your laptop is safe.

Architecture

Pages: HTML, CSS, and JavaScript served as static files (Cloudflare Pages or equivalent).
Decode: the browser reads the file you selected.
Encode: MozJPEG runs in a local Web Worker (@jsquash/jpeg). If WASM cannot start, the page falls back to canvas.toBlob.
Download: a JPG blob in page memory. You save it, or you close the tab.
CSP: built pages get a Content-Security-Policy generated at build time. Inline event handlers and inline style attributes are rejected by that build step.
Feedback: the only optional third-party write is the header form you choose to open. It sends text, not the photo in the tool.

There is no account database. The homepage, 20KB, and 50KB compressors have no image-upload API.

The large-image page can POST one file over the local cap (max 500MB) to a shrink API. That API stores the upload only for the request, returns a smaller JPG, and deletes it after the shrink. It is not a photo library.

Data lifecycle

You select up to 20 files on this device (about 80MB each on a phone, 150MB on a computer).
The page reads them locally and encodes toward the KB target (default 100KB).
You download the JPG, press Clear, or leave.
Refresh or close the tab to drop page memory.

If you then upload that JPG to a job portal, that portal’s policy applies. We cannot retract a file you already submitted somewhere else.

Threats this model reduces

Photos are not sitting on ImageTo100.com after you compress.
There is no password database to leak.
A third party cannot “process your ID in the cloud” through this tool, because the tool is not written that way.
A tight CSP reduces the chance that a stray inline script runs on a built page.

What this does not prevent

A malicious browser extension on your machine can still see page contents.
A compromised or shared computer can still read the download folder.
Shoulder-surfing and screen recording are outside the site.
If you email an ID photo to anyone — including us — that photo is now in email.
Look-alike domains. Check the address bar: imageto100.com.
Best-effort compression of a huge file at 10KB is a quality limit, not a security incident.

Reporting a vulnerability

Email contact@imageto100.com with:

The URL and what you observed
Steps to reproduce
Impact (for example: unexpected network call while compressing)

Do not include live secrets, customer data from other systems, or a real passport scan.

We do not run a paid bug-bounty program. Serious, reproducible reports about imageto100.com are still useful.