VERT is a file converter that does the work on your own device. Open the site, drop in images, audio, documents or video, pick a format, and the conversion runs in the browser tab with WebAssembly instead of being uploaded to someone's server. It handles more than 250 formats, has no file size limits, and offers per-format settings in a clean Svelte interface.
That is the reason it is on the list: most free online converters ask you to upload private files to a stranger. You can use the public instance at vert.sh, or run your own copy from the Docker image in a couple of minutes, in which case nothing has to touch the project's servers at all.
The exception is video. Simple video conversions run in the browser, but heavier ones go to vertd, a small FFmpeg server, and by default that is VERT's hosted instance. If you care about privacy, run vertd yourself and point VERT at it in the settings.
- Repository: github.com/VERT-sh/VERT
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: TypeScript. Stars: 16.1K. Forks: 857. Last push: Oct 20, 2026.
- Scan: safe, Oct 26, 2026, commit 257bcb3
Who it is for
Anyone who converts files now and then and would rather not upload them, and people who want a self-hosted converter for their home server or team.
Getting started
1. Use it in the browser, nothing to install
open https://vert.sh2. Or self-host the prebuilt image, then open http://localhost:3000
docker run -d --restart unless-stopped -p 3000:80 --name vert ghcr.io/vert-sh/vert:latestSettings such as analytics and the video server are baked into the prebuilt image. To change them, for example PUB_DISABLE_ALL_EXTERNAL_REQUESTS=true for a fully offline copy, build the image yourself as docs/DOCKER.md describes.
Safety scan
We cloned VERT-sh/VERT at commit 257bcb3 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits, no install hooks, no committed binaries and no bare-IP URLs. The Stripe key in .env.example is a publishable key, which is public by design and used for the donation button.
- The external hosts are the project's own: vertd.vert.sh (with EU and US instances) for server-side video, plausible.io for analytics on the public site, and Stripe for donations. One setting, PUB_DISABLE_ALL_EXTERNAL_REQUESTS, turns all of them off in a self-built copy.
- No advisories were reported, but that is because the project uses Bun and its bun.lock file is not one the scanner reads, so treat the dependency picture as unchecked rather than clean.
- Two workflows, none using pull_request_target; none of the 5 third-party actions is pinned to a commit. Licence and contributing guide present; no security policy, Dependabot or CodeQL. There are no tagged releases; the Docker image tracks the main branch.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 5 of 5 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 19 distinct hosts referenced from source; most often github.com, vert.sh, plausible.io, developer.mozilla.org. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
By the numbers
| Stars | 16.1K |
|---|---|
| Forks | 857 |
| Contributors | 46 |
| Commits | 990 |
| Open issues | 30 |
| Open pull requests | 3 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | AGPL-3.0 |
| Main language | TypeScript |
| Project age | 1 year |
| Last push | Oct 20, 2026 |
| Tracked files | 188 |
| Lines of code | 28.5K |
| Checkout size | 2 MB |
Lines by language: TypeScript 12.7K, Svelte 7,777, JSON 6,240, JavaScript 728, SCSS 456, Markdown 263.
Questions
Is VERT free?
Yes. VERT is free and AGPL-3.0, which means anyone running a modified version as a public service must share their changes. The public instance at vert.sh asks for donations but has no paid tier.
Does VERT upload my files?
Images, audio and documents are converted in your browser and never leave your device. Some video conversions go to a vertd server, by default VERT's own; self-host vertd to keep video local as well.
Can I run VERT offline?
Yes, if you self-host it. Build the Docker image with PUB_DISABLE_ALL_EXTERNAL_REQUESTS=true and run your own vertd for video, and it needs no outside connection.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.