Does VERNAM Upload Your Files or Require an Account?

No. VERNAM encrypts and decrypts files entirely inside your browser, so your file and passphrase never reach a server, and no account is needed. The site states this directly: "Everything happens inside your browser, so your files and password never touch a server. No account, no catch, free for life." It also lists "Nothing uploaded" and "Works offline" among its properties. The one condition to keep in mind is that the tool needs JavaScript enabled, since the encryption runs locally in the page.

What "nothing uploaded" means in practice

The privacy claim rests on where the computation happens, not on a promise about server behavior. VERNAM performs key derivation and encryption in the browser tab itself:

• Your file stays on your device. You drop a file in, and the encrypted or decrypted result is produced locally. The page states plainly: "No upload. Your file never leaves your device."
• Your passphrase is never stored. It is stretched into a 256-bit key with Argon2id and used only in the browser. The site notes it "is the only key, never stored anywhere," so a wrong passphrase simply fails with no recovery path.
• No account, no sign-in. There is no registration step described anywhere on the page; the workflow is drop a file, set a passphrase, done.
• Offline use is supported. Because the work is client-side, the page lists "Works offline" as a property.

A useful way to think about it: the browser tab is the entire tool. If the file were being uploaded, the page would need a server round-trip to return a result — but the stated design is that the result is computed where the file already sits.

Why the open-source claim matters for trust

Privacy claims are hard to verify from the outside, which is why VERNAM leans on auditability. The page says every line is public and open source, and that the code can be self-hosted. That gives you two ways to check the "no upload" claim rather than take it on faith:

1. Read the code. The page invites this directly: "Don't trust us, read the code." You can inspect what the page actually does with a dropped file.
2. Host it yourself. Self-hosting removes even the hosted page from the equation. The condition attached is that you keep a visible credit linking back to PrivacyTools.io.

The page also frames the security model as having "no server to hack, no account" — meaning there is no stored copy of your files or keys on a remote system to be breached. That is a structural argument, not just a policy statement.

The cryptography behind the local processing

The "nothing uploaded" design is paired with specific algorithms, which the page names:

The page compares these to the cryptography used by Signal, WireGuard, and 1Password. The signing of each chunk is worth noting: it means tampering with an encrypted file is detectable at decryption time, not just invisible.

What to check before relying on it

• JavaScript is required. The page states the tool "needs JavaScript to encrypt files locally in your browser." With scripting disabled, the local encryption cannot run.
• There is no passphrase recovery. Because the key is never stored, a lost or mistyped passphrase means the file cannot be opened — by you or anyone else. Write the passphrase down before encrypting anything important.
• High security mode has a hardware cost. The optional mode uses heavier key derivation (256 MiB memory, 3 passes with Argon2id), which the page says is "not recommended for low-RAM devices." It makes each brute-force guess costlier but can be slow or unstable on constrained machines.
• Self-hosting carries an attribution condition. If you host your own copy, keep the visible credit link to PrivacyTools.io.

Bottom line

If your concern is whether using VERNAM hands your files or passphrase to someone else, the answer supported by the site is no: processing is client-side, there is no account, and the code is open for inspection or self-hosting. The trade-offs are the ones inherent to local encryption — you must enable JavaScript, and you alone hold the only key, with no recovery if it is lost.