For businesses & data protection officers

In short

• No transfer: the file is read and repaired in the browser. Its content never reaches a server – not even mine.
• No storage: the data only lives in the memory of the browser tab. Close the tab and it is gone.
• No account, no database: there is no upload endpoint that could accept files.
• Servers in the EU: the website is hosted by Hetzner Online GmbH in a data center in Finland.

• No third parties: no analytics, no ads, no Google Fonts, no CDN.
• Enforced technically: a Content Security Policy forbids the browser to connect to other servers.

How the processing works

1. When you open the site, your browser loads the page, the stylesheet, the fonts and a JavaScript program from mojibuster.com – like on any website.
2. When you pick a file, the browser reads it from your device into memory through the File API. Nothing is sent.
3. A web worker – a background process in the same tab – detects the encoding and repairs the broken characters.
4. The browser turns the result into a download or copies it to the clipboard. That happens locally, too.

So Mojibuster is closer to a program that runs in your browser than to an online service: the server only delivers the code. Only your own device ever works with your data.

Check it yourself: the network tab

You don't have to take my word for it. Your browser's developer tools show every connection a page makes:

1. Open this page in Chrome, Edge or Firefox and press F12 (Mac: Cmd + Option + I).
2. Switch to the Network tab and clear the list with the crossed-out circle icon.
3. Drop a test file into the box above and download the result.
4. Look at the list: at most one entry file or text shows up – the anonymous counter described below. There is no request carrying your file.

Click an entry and open Payload to see what was actually sent – for the counter: nothing.

The only request: an anonymous counter

After a repair the browser sends an empty request to /count/file or /count/text. It contains no file content, no file name, no size and no identifier. For it, the server writes only the date and the kind (text or file) to a separate counter file – no IP address, no time of day, no browser. That's how I know how often the tool is used. Details are in the privacy policy.

Check it yourself: the offline test

An even clearer test works without internet, because Mojibuster runs offline too:

1. Open this page once while online. The browser keeps the program code in its cache.
2. Disconnect: turn off Wi-Fi, unplug the cable, or set throttling to Offline in the Network tab of the developer tools.
3. Reload the page and repair a file. It works – without a connection nothing can be transferred.

From the browser menu (Install app or Add to Home Screen) you can also install Mojibuster as an app.

Technical lock: Content Security Policy

On top of that, the server sends a strict Content Security Policy (CSP) with every page. This header defines where a page may connect to at all. It is enforced by the browser – not by my code. Even a faulty or tampered script couldn't send data to a foreign server.

• connect-src 'self': scripts may only talk to mojibuster.com, to no other server.
• script-src 'self' plus hashes: only the site's own JavaScript runs, no code loaded from elsewhere.
• default-src 'self', form-action 'none', frame-ancestors 'none': no foreign images, fonts, frames or form targets.

You find the header in the developer tools under Network → first entry (the document) → Response Headers → Content-Security-Policy.

Service providers

Mojibuster embeds nothing from other providers: no Google Fonts, no CDN, no analytics or ad services, no social media plugins. Fonts and icons are served from the site's own server.

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The server is located in Finland (EU).
• Access log: like every web server, it logs requests – with shortened IP addresses, deleted after 30 days. File contents never appear in it, because they never leave the browser.
• Browser storage: your theme and language choice plus the program code for offline use. A cookie is only set if you pick a language yourself.

Do we need a data processing agreement?

In my assessment, no. A data processing agreement under Art. 28 GDPR is required when a service provider processes personal data on behalf of your organization. With Mojibuster, your organization processes the file itself, on its own device. The content never reaches me: I can neither see nor store it. Mojibuster only provides the program code – much like software you download and run locally.

Opening the website itself creates technical access data, as on any website. I am the controller for that; it is described in the privacy policy.

Important: this is not legal advice. Please clear the use with your data protection officer – this page is meant to make that review easier.

Limits you should know about

• Browser extensions can read along on any website, this one included. For confidential data, use a browser profile without extensions.
• The repaired file ends up in your downloads folder. The same internal rules apply to it as to the original.
• The code can change, for example with updates. That's why the network and offline tests can be repeated at any time.

Frequently asked questions

More guides

• Mojibake fixer for all kinds of text Repair garbled characters in text and files.
• Fix CSV encoding Repair special characters in CSV exports and save as UTF-8.
• Excel characters When Excel shows é instead of é after opening a CSV.
• Fix UTF-8 Remove mojibake from databases, emails and websites.
• Fix subtitles Repair SRT and VTT subtitles with broken characters.
• Double-encoded When é first became é and then é.
• WordPress & database Repair SQL dumps and WordPress content showing é instead of é.
• Customer data & CRM Repair customer lists from CRM and ERP without uploading them.