Security

Files are treated as untrusted

• File type is determined from the file's signature, never from the extension.
• Image decoding runs off the main thread in a worker.
• Resource limits are applied before decoding, including file size, pixel count and image count.
• Outputs are re-read and validated before they are offered for download.
• Uploaded content is never executed.

Local processing reduces exposure

Because processing happens in your browser, files stay on your device for the standard tools. That removes the usual server-side attack surface for crafted images.

Codec dependencies

The HEIF decoder and parser are pinned to specific versions and reviewed when security updates are released, because image codecs are a common target for malicious files.

What we can and cannot promise

No decoder is 100% safe. Our guide Can a HEIC file contain a virus? lists the real HEIF and HEVC decoder vulnerabilities, which versions of libheif and libde265 this site ships, and the tests we ran on hostile files.

Reporting a problem

If you believe you have found a security issue, please email hello@heic.fyi rather than posting it publicly, and include the smallest file or steps that reproduce the problem. Our machine-readable policy is at /.well-known/security.txt; see also the contact page.