Privacy: every request this tool makes

Two hosts, two request shapes, both triggered only by a button you press. No server of ours, no cookies, no referrer, no storage and no analytics.

Links are parsed in your browser with no network access. Pressing Fetch requests public files directly from i.ytimg.com and www.youtube.com — no server of ours is involved, and nothing is stored.

Why this product does not claim local-only processing

Twelve of the tools on this site display a specific sentence: your files are processed locally in your browser and are not uploaded. That sentence is enforced by a test suite that intercepts every request and fails if anything leaves.

This tool cannot honestly display it. Fetching a thumbnail means fetching a file from Google, and pretending otherwise would be a lie told in a privacy badge, which is the worst possible place to tell one. So the registry records localProcessing as false for this product, the badge says what actually happens, and the browser’s own Content-Security-Policy is widened to permit exactly the https requests described below.

The complete list of requests

GET https://i.ytimg.com/vi/<video id>/<size>.jpg — or the vi_webp path for WebP. One request per thumbnail size, made when you press Fetch.

GET https://www.youtube.com/oembed?url=<watch url>&format=json — one request, made at the same moment, for the public title and channel.

That is the entire list, and it is enforced rather than promised: the caption-URL field accepts only www.youtube.com, so it cannot widen this list. A test fails the build if that allowlist ever grows beyond the hosts named on this page. Every request is an anonymous GET for a public file, sent with credentials omitted and a no-referrer policy, so no cookie is sent and no referring page URL is disclosed. One thing IS disclosed and it would be wrong to imply otherwise: a cross-origin fetch always carries an Origin header, so Google is told which site made the request — it just is not told which page. Nothing is ever posted.

What happens before you press Fetch

Nothing on the network. Parsing the link, extracting the video id, reading a timestamp, building watch, share and embed URLs and generating embed code are all string operations performed in the page.

The status line under the input says so explicitly, and it keeps saying so until a request has actually been made.

What is stored

Nothing. There is no account, no database, no cookie set by this site, no local storage of your links and no history. Closing the tab discards everything, including any thumbnail already fetched.

Ads and analytics are disabled across this entire site, and that is enforced by a validator that fails the build if any product turns either on.

What Google can see

Because the request goes directly from your browser to Google, Google sees your IP address and the fact that a particular thumbnail was requested, in the same way it would if you loaded the watch page. The no-referrer policy means it is not told which page asked.

This is the honest trade: removing the intermediary means nobody else sees your request, but it does not hide you from the host actually serving the file. A tool that proxied the request through its own server would hide you from Google and expose you to whoever runs that server instead.

Questions

Does the page contact anything on load?

No. Loading the page fetches only this site’s own files. The first third-party request happens when you press Fetch, and not before.

Are the fetched images uploaded anywhere?

No. A fetched image is held in memory in your browser, shown through a blob URL and discarded when you leave. Pressing Download writes it to your device directly.

Is there any tracking?

None. No analytics script, no tag manager, no advertising pixel, no fingerprinting. The site-wide validator refuses to build if an analytics or advertising identifier appears anywhere in the source.

Limitations

  • This tool contacts two Google hosts when you press Fetch; it cannot show you a thumbnail without doing so.
  • Google can see your IP address when your browser requests a file from it, exactly as it can when you visit YouTube.
  • Nothing is stored, so nothing can be recovered after you close the tab.

Last reviewed 2026-09-14.