Offline Document Redaction: Zero Uploads, Zero Cloud

Offline Document Redaction: Redact Sensitive Files Without Cloud Uploads

Offline redaction means no file ever leaves your device. Most commercial redaction tools operate as web services: you upload a document, the server processes it, and the redacted file downloads back. Each step transmits document content to third-party infrastructure. An offline browser-based tool avoids every upload by running the entire OCR and redaction pipeline inside your browser using WebAssembly.

The OCR Redactor loads Tesseract WASM once and caches it locally. Every subsequent session runs entirely offline; no network access to your document data occurs at any point. You can verify this by disconnecting your internet connection after the page loads and processing a document. The tool functions identically without connectivity because neither OCR nor redaction requires a server.

How offline processing works technically

WebAssembly allows binary code compiled from C++ to run inside the browser at near-native speed without any browser plugin.¹ Tesseract's C++ source code compiles to a .wasm binary that downloads once on first use and stores in the browser cache. Subsequent visits to the OCR Redactor load the WASM binary from the local cache with no re-download. The typical download size for the Tesseract WASM engine plus English language data is approximately 2 megabytes on the first visit, after which the browser serves the cached version without any network cost on subsequent loads.²

WebWorker isolation and local CPU processing

During OCR processing, the JavaScript on the page sends the image data to a browser WebWorker, which runs the Tesseract binary in an isolated thread.³ Consequently, the image data never touches any network interface at any point in the pipeline, and the entire computation runs on your local CPU. CapyToolkit's architecture ensures that no document bytes pass through any external server at any stage of the OCR and redaction workflow. The WebWorker thread model also means that closing the browser tab immediately terminates the worker process and releases all memory allocated by the WASM binary, leaving no residual data on the machine.

Running recognition in a worker also keeps the page interface responsive during long scans. CapyToolkit's OCR Redactor keeps the image rendering and your rectangle drawing on the main thread while the WASM binary does the heavy lifting in the background, so the redaction canvas never freezes mid-document. Because the worker communicates with the page only through copied data, the document bytes stay local and never pass through a socket or external service during the recognition step.

Verifying zero uploads during processing

Open the browser's network panel before dropping a document into the tool. Press F12, click Network, then load the page. After the page finishes loading, drop your document into the drop zone and watch the network panel. No new requests appear during OCR processing, rectangle drawing, or export. The only requests visible in the panel are the initial page load assets: HTML, CSS, JavaScript, and the Tesseract WASM binary. Building on this, you can confirm that the exported file downloads directly to your machine without passing through any server by observing the download source in the browser download manager. It shows a blob URL, not a remote server address.⁴

When to choose offline over cloud-based redaction

Cloud redaction tools offer convenience features such as batch processing, auto-classification of sensitive fields, and team collaboration workflows. Yet those features come with a fundamental tradeoff: every document uploaded to a cloud service becomes subject to that provider's data retention policies, breach risk, and legal jurisdiction. For regulated industries such as healthcare, law, and finance, any upload of a patient record, privileged communication, or financial statement to a cloud service requires a formal data processing agreement. Offline processing eliminates that exposure by keeping the document inside your own system boundary, making it suitable for regulated contexts without any special configuration.

What "offline" means for a browser-based tool: cache, storage, and memory

Offline operation for a browser-based tool has a specific technical meaning. The Tesseract WASM binary and language data files download once and store in the browser's Cache API storage, which persists across sessions independently of the page being open.⁵ After the initial download, reloading the OCR Redactor page loads both files from the local cache without any network request, even if the internet connection is severed. Processing starts from the cached state. No document data, image bytes, or extracted text touches any network interface at any point during a session.

Browser storage in this context is distinct from document storage. The Cache API holds only the Tesseract engine files, not any document you process. Documents exist only in RAM during the active browser session: the image object loaded into the canvas, the Tesseract recognition output, and the drawn rectangle data all live in process memory. Closing the browser tab releases all of this memory; nothing persists to disk. Consequently, the OCR Redactor leaves no trace of processed documents in any browser storage location after the session ends.

Offline availability after initial load on different browsers

Safari on iOS and macOS caches WASM binaries via the Service Worker Cache API, but Safari applies eviction policies that may clear cached resources after a period of disuse. If the OCR Redactor page has not been visited for several weeks on Safari, the WASM binary may need to re-download on the next visit. Chrome and Firefox apply less aggressive eviction and retain cached resources for longer periods. For environments where offline operation is required reliably without a guaranteed re-download opportunity, Chrome or Firefox on desktop provide the most dependable offline availability after the initial caching session.

Air-gapped environments and offline redaction without any prior internet access

Air-gapped systems have no internet connection at any time. Loading the OCR Redactor on an air-gapped machine requires a different approach than relying on the Cache API: the tool must be served from a local web server on the same network or from a local file. Self-hosting the OCR Redactor on a local HTTP server makes it accessible within the air-gapped environment to any machine on the same internal network segment. The self-hosted version requires bundling the Tesseract WASM binary and language data alongside the application files, so the browser retrieves them from the local server rather than from any external CDN.

For single-machine air-gapped use, running the OCR Redactor as a static site from a local file path (file:// protocol) works in Chromium-based browsers but not in Safari or Firefox, which apply additional restrictions on WebAssembly execution from file URLs. A minimal local HTTP server such as Python's http.server module or the npx serve command, started from the directory containing the built application files, provides the correct serving context for all browsers.

Using the browser network panel to confirm zero document transmission

Before committing to offline redaction for a sensitive workflow, verify the tool's behavior using the browser's built-in developer tools. Open the Network tab in DevTools (F12) before dropping a document into the OCR Redactor. After the page fully loads, clear the network log in the panel. Then drop the document, wait for OCR to complete, draw a redaction rectangle, and export. Review every request in the network log. Only requests for the initial page load assets should appear; any request that transmits image bytes or text to an external host would appear as a POST or PUT request to a non-localhost domain. The absence of such requests confirms the tool operates as documented.

When to use this

Use offline redaction when your document contains confidential personal data, trade secrets, legal case details, or health information that must never leave your device or network under any circumstances, and run it through the zero-upload offline OCR workflow to keep every byte local.

Examples