Verify barcode values stay on this device

Q: Is the JsBarcode script load an upload of my SKUs?

No. It is a GET of /assets/vendor/JsBarcode.all.min.js from this site when the page loads. The response is the MIT-licensed library. Your values are not in that request or that file. Encoding then runs in the tab.

LocalBarcode draws Code128 and EAN barcodes, and can pack a CSV into a PNG ZIP, entirely in the browser. This page is the check you can run yourself: which network calls are normal, and which calls would mean your values left the tab. The generator is on the home page. The short policy is the privacy policy. The usage rules are the terms.

What you are proving

You are proving that generating barcodes does not upload SKUs, EANs, or CSV rows. You are not proving that nothing on your computer can see the bytes. A browser extension, malware, or a recorder you installed can still read a tab. This site does not receive those values, and it does not claim to block other software on the device. Values never leave this device through this page.

Also remember: drawing bars is not GS1 registration. Even a perfectly local tool cannot assign official product numbers. See the GS1 disclaimer.

Steps in DevTools

Open the generator. Use a throwaway test value or a tiny CSV the first time — not your full production catalog — until you trust the flow.
Open DevTools → Network. In Chrome that panel is documented as the Network panel. In Firefox it is the Network Monitor. Enable “Preserve log” so a reload does not wipe the list.
Reload the page once and let the first requests finish. You should see same-origin GETs for the document, /assets/styles.css, /assets/vendor/JsBarcode.all.min.js, /assets/vendor/jszip.min.js, /assets/tool.js, and the favicon.
Type a single value and generate a preview. Change symbology between Code128 and EAN. Watch for new rows. There should be no POST, PUT, or beacon whose body is the barcode value.
Switch to CSV bulk → ZIP. Paste a few rows or choose a small .csv. Generate and download the ZIP. The ZIP is built in the tab with JSZip; it is not a multipart upload of your CSV to our server.
Optional: clear the tool and confirm status text returns to idle. Closing the tab drops in-memory inputs and object URLs.

Expected requests

Page assets. HTML, CSS, vendored JsBarcode, vendored JSZip, tool.js, and the icon — all GET, all from this site — when the page loads. Those scripts are library code, not your inventory list.
Analytics beacon, maybe. The privacy policy describes Cloudflare Web Analytics. If that product is enabled for the zone, a request to cloudflareinsights.com can show up. It is a page-view beacon. It is not an upload of SKUs, EANs, or CSV rows. The HTML we ship does not include an advertising script.

Requests that should not appear

A POST, PUT, or PATCH that carries barcode values or CSV contents.
A call to a third-party “barcode API”, cloud label printer, or catalog sync endpoint after you type or drop a file.
A script load from an ad host. Response headers for this site set a strict script-src to 'self'. That policy does not list an ad network.

Why the values can stay in the tab

Single mode feeds your string to JsBarcode, which draws SVG/canvas bars locally. Bulk mode parses CSV text in JavaScript, draws one PNG per valid row, and packs them with JSZip into a downloadable blob URL. When you close the tab, those values go with the page’s memory. We have no account database to reopen.

This tool draws linear barcodes (Code128 / EAN). It does not draw Wi‑Fi or vCard QR codes — that is WifiSignQR’s job.

Where to go next

Questions about this wording, email contact@localbarcode.pages.dev. Do not send your real inventory CSV or production GTIN list in that email. We do not need it, and we do not want it in a mailbox.

Sources

Chrome DevTools — Network panel: developer.chrome.com/docs/devtools/network
Firefox — Network Monitor: firefox-source-docs.mozilla.org/…/network_monitor
MDN — FileReader: developer.mozilla.org/…/FileReader
MDN — Canvas API: developer.mozilla.org/…/Canvas_API
JsBarcode (MIT) — the script you see in Network is served from this site: github.com/lindell/JsBarcode
JSZip (MIT) — same-origin vendor copy: github.com/Stuk/jszip
GS1 — get barcodes (why drawing ≠ registration): gs1.org/standards/get-barcodes

FAQ

How do I prove LocalBarcode does not upload my barcode values?

Open DevTools → Network, type a test value or drop a tiny CSV, then generate. You should see same-origin page assets. You should not see a POST or PUT of the values. The JsBarcode and JSZip GETs are encoder/packer code, not your inventory.

Is the JsBarcode script load an upload of my SKUs?

No. It is a GET of /assets/vendor/JsBarcode.all.min.js from this site when the page loads. The response is the MIT-licensed library. Your values are not in that request or that file. Encoding then runs in the tab.

What does Download barcodes.zip send to the server?

Nothing required. The ZIP is built in the tab with JSZip from PNG blobs drawn locally, then offered as a download via a blob URL. It is not a multipart upload of your CSV.

Which network requests are a problem?

A problem is any request that sends barcode values or CSV contents, or calls a third-party barcode/label API after you type. Static assets and an optional Cloudflare Web Analytics beacon are not value uploads.

Does this check cover EAN as well as Code128?

Yes. Switch symbology while Network is open. Both paths use the same local libraries. The Code128 vs EAN guide covers when to pick each format.

Can the page still leak values some other way?

This check covers requests from the page. It does not stop a malicious extension, shared-computer shoulder surfing, or leaving the tab open. Generate on a device you control, then close the tab. Do not email us your production CSV.