Are online PDF tools safe? How to protect your files

The problem with uploading documents

Most online PDF tools work by uploading your file to a server, processing it there, and sending back the result. That is convenient, but it means a copy of your document, and everything in it, leaves your device. For a menu or a flyer that hardly matters. For a contract, a bank statement, a medical record or an ID scan, it deserves some thought.

Reputable services state how long they keep uploaded files and delete them automatically, but you are trusting their word and their security. A breach, a misconfigured server or a careless employee can expose files that were never meant to be shared.

The alternative: processing in your browser

Modern browsers are powerful enough to process many PDF tasks locally, using JavaScript running on your own device. In that model the file is read from your disk into your browser, changed there, and saved back to your disk. It is never sent anywhere, so there is nothing on a server to leak.

This is how the tools on this site work. Merging, splitting, rotating, watermarking, numbering and converting all happen on your device.

How to check whether a tool uploads your files

You do not have to take anyone's word for it. You can check yourself in a few minutes.

1. Open the tool in your browser and press F12 (or Cmd+Option+I on a Mac) to open the developer tools.
2. Click the Network tab and clear the list.
3. Use the tool on a small test file.
4. Look at the requests that appear. If you see a large upload (a POST request carrying your file), the file is being sent to a server. If you only see small requests, or none, the file stayed on your device.

Other habits that help

• Prefer tools that run in the browser for anything sensitive.
• Read the privacy policy for how long uploaded files are kept and who can access them.
• Remove metadata and hidden content you do not want to share before you send a document.
• Do not use unfamiliar tools that ask for an account or an email address just to merge two files.
• Keep your browser and operating system up to date.

A note about limits

Local processing has trade-offs. Very large files depend on your device memory, and some heavy features, such as OCR on scanned pages, are harder to do entirely on a device. For everyday jobs like merging, splitting and converting, working locally is a good default.

What is actually at risk?

When you upload a document, the risk is not just what you can see on the page. A PDF can also carry hidden information: the author's name, the software used, the dates it was created and edited, and sometimes earlier text that has been covered rather than removed. Uploading it gives a third party a copy of all of that, even if they only intended to merge or convert it.

The type of document changes how careful you should be. A public flyer is low risk. A contract, a payslip, a medical letter, an identity document or a bank statement is high risk, and those are exactly the files people most often need to merge, split or convert.

Signs of a trustworthy tool

• A clear privacy policy that states what happens to your files and how long they are kept.
• Processing that happens in your browser, so nothing is uploaded.
• No need to create an account or hand over an email address for a simple task.
• A site served over HTTPS, which you can see from the padlock in the address bar.
• A contact address and information about who runs the site.

Warning signs

• A tool that insists on an account, or on installing software, for a basic conversion.
• Vague or missing privacy information.
• Promises that sound too good to be true, such as unlimited processing with no explanation of how it is funded.
• Pages crowded with misleading download buttons and pop-ups.
• Requests for permissions that have nothing to do with the task.

Protecting sensitive documents before you share them

Even with a private tool, it is worth thinking about what a document reveals once it leaves your hands. Before sending a PDF to someone else, check whether it contains information they do not need, such as personal numbers, addresses or account details. Where you can, extract only the relevant pages with the Split PDF tool rather than sending the whole file.

If you have hidden text under a black rectangle, do not assume it is gone. Covering text with a coloured box in an editor may leave the text underneath. Use proper redaction features in your PDF software, and test the result by trying to select and copy the area.

Frequently asked questions

Is HTTPS enough to make a tool safe? HTTPS protects the connection between you and the site. It does not tell you what the site does with your file once it arrives.

How can I verify that a site does not upload files? Use your browser's network tab as described above and watch for large upload requests while you use the tool.

Does a browser-based tool work offline? Once the page has loaded, processing runs on your device. If you want to be certain, you can disconnect from the internet after the page loads and try the tool.

Why do some tools upload files anyway? Server-side processing is simpler to build and is needed for heavy features, so many services choose it. It is not necessarily unsafe, but it does mean you are trusting the provider.