How it reads your file, in your browser
The Wrapped is a static page. A worker in your browser tab reads your files and hands back counts. The page’s security policy blocks the requests that could send them anywhere.1
Checked against the tool’s code on 29 October 2026.
Check it yourself
Three ways, from quickest to most thorough.
- Go offline
Open the home page, turn off Wi-Fi, then choose your files. The reader starts as the page loads, so it works the same with no connection.
- Watch the Network panel
Open your browser’s developer tools, go to Network, and make your Wrapped. No request goes out while your files are read.
- Read the policy
Every page is served with connect-src 'none' and form-action 'none'. The browser then blocks fetch, XMLHttpRequest, WebSocket, EventSource, sendBeacon and form posts.1, 2
The code is plain, unminified JavaScript in /js/. The only code we didn’t write is fflate 0.8.3 for unzipping (MIT license), served from this site, unmodified, with its SHA-256 in /vendor/fflate/VERSION.txt.
What it reads, file by file
Inside an archive, only mail, activity, Chrome and Timeline files are opened, picked by their names. Photos, videos and Drive files are passed over unread.
| File | Read | Skipped |
|---|---|---|
| Mail (.mbox) | Three headers per message: From, Date and X-Gmail-Labels | Subject, To, Cc, every other header, the message and its attachments |
| My Activity (JSON or HTML) | The time, the product, the link, and the channel for YouTube | Search terms, page titles and place names stay inside the worker, used only to sort and de-duplicate entries |
| Chrome history | The time and the site of each page | The rest of each address and the page title |
| Timeline file from your phone | Visit times, place IDs and coordinates, and the distance and type of each trip | Raw location records (Records.json) in older exports are never opened |
What happens when you choose a file
Zip and tgz archives
A zip keeps an index at its end. The reader loads only that index, picks the files above by name, and unpacks just those, 4 MB at a time. Large zip64 exports work too.
A tgz has no index, so it is read from start to end, and files it doesn’t need are dropped as they pass.
What comes back
Totals, counts by hour, weekday and year, and short lists of up to five names, such as the senders, channels and sites you see most. That is all that leaves the worker for the slides.
Nothing goes into cookies or browser storage. Close or reload the tab and it’s gone.
The share card
It is drawn in the tab from the numbers you tick, then saved to your downloads as a PNG. You can only pick totals and averages, never a sender, search, channel or place.
Numbers to read with care
Why does it count videos, not hours?
Google’s schema for activity records lists a time, a title and a link, and no watch time.3 So the Wrapped counts the videos you opened.
Why does my busiest hour look shifted?
Times are shown in this device’s time zone. If you lived somewhere else for years, those years shift.
Why are there no sent or unread counts?
They come from the X-Gmail-Labels header, which Gmail adds to each exported message.4 An .mbox from another mail service has no such header, so those numbers are left out.
Which My Activity format should I pick?
My Activity exports as HTML or JSON, and the Wrapped reads both.3 If your account isn’t in English, pick JSON: the Wrapped reads JSON dates in any language, and HTML dates only when they are written in English. A single JSON file over 512 MB is skipped, with a note on the first slide.
Sources 4
- Content-Security-Policy: connect-src directive, MDN Web Docs. Read 29 October 2026.
- Content-Security-Policy: form-action directive, MDN Web Docs. Read 29 October 2026.
- My Activity Schema Reference, Google Data Portability API documentation. Read 29 October 2026.
- How to download your Google data, Google Account Help. Read 29 October 2026.
Every claim about the tool on this page was checked against its code on the date shown. How we check