Security

Last updated November 14, 2026

Your video stays on your computer

• Clipstack runs entirely in your browser. Your clip is read from your disk and never uploaded.
• Exports are made in your browser and downloaded straight to you.
• No accounts, cookies, analytics, ads or tracking.
• The page makes no requests to any other website. Every file it uses is served from this site.
• The only thing saved in your browser is whether you closed the quick start tips. Your edit isn't saved: close the tab and it's gone.

Security rules the site sends

Every page is served with these response headers:

• Content-Security-Policy: the browser may only run scripts, styles, fonts and images from this site, and may not contact any other server. Two exceptions, both needed by the bundled AAC audio encoder: wasm-unsafe-eval lets it run WebAssembly (compiled code that runs in the browser's sandbox), and worker-src blob: lets it start its background worker from memory. Neither allows code from another site.
• X-Frame-Options and frame-ancestors 'none': other sites can't embed Clipstack in a frame to trick you into clicking.
• X-Content-Type-Options: nosniff: files are only treated as the type they're served as.
• Referrer-Policy: no-referrer: links you follow don't tell the next site where you came from.
• Permissions-Policy: camera, microphone, location, USB and payments are switched off.
• Strict-Transport-Security: browsers only ever load this site over HTTPS.

Third-party code

All of it is copied into the project and served from here, never from a CDN. Versions and licenses are in the repository.

• Mediabunny 1.66.0 (MPL-2.0): reads your clip and writes the MP4.
• Mediabunny AAC encoder 1.66.0 (MPL-2.0), containing FFmpeg's AAC encoder (LGPL): used when your browser has no built-in AAC encoder, such as Firefox.
• Bangers font (SIL Open Font License).
• Noto Color Emoji by Google (Apache-2.0): the emoji you add. Each image loads only when you use it.
• emojibase-data 18.0.0 (MIT), built on Unicode and CLDR data: emoji names and search words.

The ffmpeg command

The ffmpeg export gives you a command to run on your own computer. Read it before you run it. Clipstack builds it so it can't do anything except make your video:

• All editing instructions go in filter.txt, not in the command itself.
• Text you type is limited to 60 characters, and quotes, backslashes and control characters are removed.
• If your clip's file name has characters a terminal could treat as code, the command uses a safe name and asks you to rename the file first.

Report a problem

Found a security issue? Please report it privately through GitHub's private vulnerability reporting rather than opening a public issue. Machine-readable contact details are in security.txt.