Skip to content

← All writing

Are Online PDF Tools Safe? What Happens When You Upload a File

· by Andergrove Software

Search for "merge PDF" and the entire first page of results wants the same thing: your file. Upload it, and a server you know nothing about receives a copy of your contract, invoice or medical record, processes it, and — for some period, under some policy — keeps it. Millions of people do this every day without a second thought. Mostly, nothing bad happens. But "mostly" is doing a lot of work in that sentence, and PDFs are disproportionately the documents where it matters.

What actually happens when you upload a PDF

An upload-based PDF tool is a web front-end to a server-side conversion pipeline. Your file travels over TLS to the provider's infrastructure (often a cloud bucket), a worker process performs the merge or conversion, the result is written somewhere downloadable, and — in the well-run case — both copies are deleted on a schedule. From the moment you press upload, at least three copies of your document briefly exist outside your control: the upload, the working copy, and the output.

None of that is sinister; it is just how server-side processing works. The questions that matter are ordinary data-handling questions: who operates the server, in which jurisdiction, how long the copies live, who can read them in the meantime, and whether the business model is the tool itself or the data passing through it.

How long does your file live on their server?

Reputable services publish a retention window — typically "files are deleted after one hour" or similar wording. Take three things into account when you read one:

  • Retention claims are unverifiable from the outside. You are trusting the operator's word and their operational discipline — backups, logs and crash dumps have a way of outliving deletion schedules.
  • Free tools have to pay for the servers somehow. Ads are the honest version. A tool with no visible business model deserves more suspicion, not less — worthless services do not pay for the bandwidth of processing millions of documents out of kindness.
  • Many tools are anonymous. No company name, no jurisdiction, a privacy policy last touched years ago. If you cannot tell who is receiving your file, treat the answer as "anyone".

Documents you should never upload

A sensible rule: never upload a document you would not email to a stranger. In practice that covers most of what people merge and split — signed contracts, bank and brokerage statements, tax returns, medical results, payroll documents, identity documents, and anything under an NDA. It is exactly these documents that end up in PDF form, which is what makes the casual upload habit riskier for PDFs than for, say, resizing a meme.

For corporate work there is a second problem: uploading a client's document to a third-party service can breach a confidentiality agreement or data-protection obligation all by itself, regardless of whether anything leaks. "The merge site said files are deleted within an hour" is not a sentence anyone wants to say in that conversation.

The alternative: PDF tools that run in the browser

Here is the part most people do not realise: for many PDF operations, the upload is unnecessary. Merging, splitting, reordering and extracting pages are structural operations on the file — no heavyweight rendering required — and modern browsers can run the whole job locally with JavaScript or WebAssembly. The file is opened by code running on your machine, the pages are copied on your machine, and the "download" is your browser writing a local file it already has.

Our PDF Merger & Splitter works this way, as do a small but growing number of tools elsewhere. Client-side processing is also usually faster for the user — no upload and download round trip — which is a pleasant side effect of the privacy-preserving design.

How to check whether a tool is really local

Any site can write "we don't store your files". Two checks that do not rely on trust:

  • The offline test. Load the page, then disconnect from the internet (aeroplane mode works) and run the operation. A genuinely client-side tool still produces its output; an upload-based one fails immediately.
  • The network tab. Open your browser's developer tools, switch to the Network panel, and watch while you process a file. A local tool shows no request carrying your file; an upload-based one shows a large POST the moment you add it.

Thirty seconds of either test tells you more than any privacy policy.

A sensible checklist

  • Prefer tools that process files in the browser, and verify with the offline test when the document matters.
  • If you must upload: named company, stated retention, recent policy, HTTPS — and still not for identity, medical, financial or NDA material.
  • For genuinely sensitive documents that need server-side processing (OCR, heavy conversion), use software you install, or your organisation's approved tooling.
  • Remember that "delete" on someone else's server is a promise, not an action you performed.

The convenience of online PDF tools is real, and for a flyer or a public form the risk is negligible. The habit worth building is simply noticing which kind of tool you are using before the file leaves your hands — because for the operations people do most, it never needs to.