How to Query a CSV File Without Uploading It Anywhere
Most "online CSV tools" work by taking a copy of your file. You pick the file, it travels to somebody else's server, and the results come back. For a lot of work that is simply not allowed — and quite often, nobody in the chain has actually checked whether it is.
There is a second way to do it that people are often surprised exists: the query runs inside your browser tab, on your own machine, and the file never travels anywhere at all. This guide explains how that works, how to do it, and — the part that matters most — how to prove it to yourself rather than taking anyone's word for it.
Why This Matters
The usual reasons people go looking for this:
- The data is under NDA. A consultant or auditor receives client files with contractual terms about where they may be processed. Pasting them into a web tool breaches that, quietly and unprovably.
- It is personal data. Under GDPR and similar regimes, sending personal data to a third-party service makes that service a processor, which needs a contract, a lawful basis, and a record. Uploading a customer list to a free website skips all three.
- It is health or financial data. HIPAA, PCI-DSS and equivalent rules make an unvetted third party a straightforward violation, not a grey area.
- Company policy forbids it. Plenty of organisations block file uploads outright. If your only options were "upload it" or "raise a ticket and wait three weeks for a database", the work just does not get done.
- You are on a restricted or offline network. No route to the internet means no cloud tool, full stop.
- It is simply nobody's business. This is a perfectly good reason on its own and needs no further justification.
What "Runs in Your Browser" Actually Means
Your browser is already a capable computing environment. It can read a file you select, hold it in memory, and run code over it — all without a network connection, in the same way a desktop program does.
When you pick a file on a page like this one, the browser hands the page a reference to the file's contents. The page reads it into memory and does the work locally. Nothing about choosing a file causes it to be sent anywhere; that only happens if the page's code deliberately makes a network request, which this one does not.
So the distinction is not "trustworthy website versus untrustworthy website". It is a structural one:
| Server-side tool | Client-side tool | |
|---|---|---|
| Where your file goes | Onto someone else's machine | Nowhere — it stays in your browser's memory |
| What you have to trust | Their retention policy, their staff, their security, their subprocessors, their breach history | That the page makes no network calls — which you can check yourself in a minute |
| File size limits | Bounded by their upload limits and your connection speed | Bounded by your own machine's memory |
| Works with no internet | No | Yes, once the page is loaded |
| Leaves a copy behind | Usually, at least in logs and backups | No — closing the tab is the end of it |
Doing It
OmniSelect FileSQL is a client-side SQL tool. There is nothing to install and no account to create.
- Open the tool. Go to the main page. That is the only network activity involved — fetching the page itself, exactly like loading any website.
- Add your file. Click the File Select panel or drag your file onto it. It becomes a SQL table named by a single letter, shown in the Alias column — taken from the start of the filename, so
invoices.csvbecomesI. You can change the letter there if you prefer. - Write SQL. Use that alias as the table name.
SELECT * FROM I WHERE status = 'overdue'
- Run it. Click Run Query or press
Ctrl+Enter. Results appear underneath. - Export if you need to. CSV, JSON, Excel or Parquet. The download is generated in your browser and saved straight to your disk.
Nothing to install, no sign-up, and your file stays on your machine.
Open the tool →How to Verify It Yourself
You should not take this on faith, and you do not have to. There are three checks, in increasing order of how convincing they are.
Check 1 — Watch the network (about a minute)
- Open the tool and let the page finish loading.
- Press
F12to open developer tools, and choose the Network tab. - Click the clear button so the list is empty.
- Now add your file and run a query.
- Watch the list. It stays empty.
No requests means no data left the machine. This is the same tool your own security team would use, and there is nowhere for a file to hide: a request either appears in that list or it never happened.
Check 2 — Disconnect (the convincing one)
- Open the tool and let it load completely.
- Turn off your Wi-Fi, or unplug the network cable. Genuinely disconnect.
- Now add your file, write a query, run it, and export the results.
It all still works. A tool that needed to send your file somewhere could not possibly do this. It is a demonstration rather than a promise, and it takes about thirty seconds.
Check 3 — Read the code
Everything the page runs is plain JavaScript delivered to your browser, and you can read all of it. In developer tools, open the Sources tab to see every file the page loaded. Search them for fetch, XMLHttpRequest or navigator.sendBeacon — the three ways a browser page can transmit data. There are no analytics scripts, no tracking pixels and no telemetry to find.
For Security and Compliance Teams
If you are being asked to approve this tool for use on regulated data, the checks above are the substance of the review, and a reviewer can complete them without any cooperation from us.
Two further things are usually asked for, and both are available:
- An air-gapped copy. The tool can be supplied as a self-contained folder to host on your own intranet or run from local disk, removing the public website from the picture entirely.
- A signed attestation. A written statement that the build performs no network requests after load, with SHA-256 checksums for every file, so you can confirm what you deployed is what was reviewed.
Evaluating this for regulated or contractual work?
Licensing & security contact →Reasonable Questions
What is the catch?
Your own machine does the work, so very large files are limited by your available memory rather than by someone else's hardware. Files are capped at 50 MB each and a million rows. For genuinely large data — tens of gigabytes — you want a real database, and that is the honest answer.
Is anything stored in my browser afterwards?
No. Your data is held in memory for the life of the tab. Close it and it is gone. Nothing is written to local storage or cookies.
Could the site change and start uploading files later?
A website can always be changed by whoever runs it — that is true of every site you use. Two things reduce it to a manageable risk here: re-running Check 1 takes a minute and would immediately reveal it, and an internally hosted copy removes the possibility altogether, because you control when it changes.
Does this work for formats other than CSV?
Yes — Excel, JSON, XML, YAML, Avro, Parquet, TSV and plain delimited text, all handled the same way.