Is it safe to use online PDF tools?

We build browser-based file tools and test every one of them against the forms and specs people actually have to satisfy.

We build file tools, so treat this as interested advice and check it yourself — which is the whole point of the last section. The short answer is that most online PDF tools are run by competent people who are not interested in your documents, and that this is still the wrong question.

The right question is narrower: what are you handing over, to whom, and for how long?

What actually happens when you upload

A server-side tool does something like this. Your file goes over the network to a server. It is written to disk, or to object storage, so the worker process can read it. The job runs. The result is written somewhere a download link can reach. You download it. Later, a cleanup job deletes both.

That is a reasonable design. It is how you get features a browser genuinely struggles with, it scales, and it works on a ten-year-old phone. Nothing about it is sinister.

But notice how many copies exist for a while: the upload, the stored input, whatever the worker wrote to a temporary directory, the output, and whatever the backup system picked up in between. Each of those is governed by policy rather than by physics.

What “files deleted after one hour” does and does not promise

It is a real commitment and the serious services mean it. It is also narrower than it sounds.

• It is a promise about intent, not a property of the system. The file was on their infrastructure. A policy says it will be removed. Those are different kinds of statement.
• It usually covers the primary store. Backups, logs and caches are frequently on separate schedules, and the retention page rarely enumerates them.
• It cannot cover a breach that already happened. If someone had access last Tuesday, the deletion schedule is irrelevant to your file from last Tuesday.
• It does not bind the future. Companies are acquired, change ownership, change policies and change jurisdictions. Your document was uploaded under the old one.
• It does not override a legal order in the country where the servers sit.

None of that makes those services bad. It makes “deleted after an hour” a statement about process, when what you often want is a statement about architecture.

When server-side is completely fine

Most of the time. If you are merging a holiday itinerary, compressing a flyer, converting a recipe or splitting a manual, the sensible answer is to use whatever is quickest. The risk is somewhere near the risk of emailing it to yourself, which you also do without ceremony.

Where it stops being fine is reasonably predictable:

• Anything with a bank account number, salary or tax identifier on it.
• Identity documents — passports, national ID cards, driving licences.
• Medical records, and anything about someone who did not choose to share it.
• Signed contracts, legal correspondence, anything under NDA or embargo.
• Work documents where your employer has rules about third-party processing — and most have rules you have not read.

The pattern is not “sensitive to me”. It is documents about other people, and documents someone else has given you a duty to protect. Those are the ones where a copy existing briefly on infrastructure you have never heard of is a decision rather than a shrug.

The browser alternative, and its honest cost

Browsers can do most of this work themselves now. PDF.js and pdf-lib handle reading and writing; image and audio codecs compile to WebAssembly; OCR and background removal run as models loaded into the page. The file is read into memory on your device, processed there, and saved back by your own browser.

The property that matters is not that it is more secure in some abstract sense. It is that there is no copy to govern. No retention policy applies, because nothing was retained. No breach exposes it, because it was never there.

The costs are real and worth stating. Your device does the work, so very large files are slower than on a server. Some things cannot be done in a browser at all — we do not offer validated PDF/A, and the full list of what a browser cannot do is its own article. And a shared or compromised computer is still a shared or compromised computer; local processing protects the file in transit, not from the machine it runs on.

How to check any tool yourself, in two minutes

This is the part worth keeping, because it works on us as well as on anyone else. Do not take a claim on the marketing page; the network tab does not have an opinion.

1. Open the tool and press F12, then the Network tab.
2. Clear the log, then choose your file and run the tool.
3. Watch for a request carrying your file. Sort by size: an upload shows as a POST or PUT whose request body is roughly your file’s size. A tool that processes locally produces no such request, whatever the file size.

And the version that needs no developer tools at all:

1. Load the tool page and let it finish loading.
2. Turn on airplane mode, or disconnect your Wi-Fi.
3. Run the tool on a file.

If it works offline, nothing was sent anywhere — there was nowhere to send it. If it fails, the work was happening elsewhere. There is no way to fake either result.

We ran a version of this test across fifteen popular file services and published what each one actually transmitted: the measurements are here. Our own tools are in it as the control.

What to look for, whichever you choose

• HTTPS, obviously — but it only protects the transfer, not what happens at the other end.
• A retention statement with a number in it. Vague is worse than short.
• Someone to contact. A tool handling your documents with no named operator and no address is telling you something.
• Stated limits. A tool that admits what it cannot do is more trustworthy than one that claims everything works perfectly.
• No account required for a one-off job. If a merge needs your email, the file is not the only product.

The short version

Server-side tools are mostly fine and the good ones are honest about retention. For documents about other people, or documents you have been trusted with, prefer an architecture where no copy exists at all — and verify it with the network tab rather than the homepage. Two minutes, once, and you never have to wonder about that tool again.

Our own tools run entirely in the browser: how that works · privacy and limits · who builds this.