Are online PDF tools safe to use?

What happens when you use a typical online PDF tool

Most PDF websites work like a post office. Your browser sends the whole file to the company's servers, a program there merges, compresses or converts it, and you download the result. For a few minutes or hours, a copy of your document exists on a computer you do not control, often in a different country, along with the file name and the address it came from.

Reputable services say how long they keep uploads, commonly somewhere between one hour and a day, and that staff do not open them. Many of them keep that promise. The trouble is that you cannot check it, and a promise does not protect a file from a breach, a misconfigured storage bucket, a legal request or a company that is sold and changes its policy.

The real risks, in order of likelihood

• Retention: the copy stays on the server longer than you expect, in backups and logs as well as in the main storage.
• Fake tools: some "free converter" sites exist to push software downloads or browser extensions. A PDF tool never needs you to install anything to merge or compress a file.
• Breaches: any service that stores files can leak them. The more people upload, the more attractive the target.
• Metadata: even when the contents are deleted, the file name, its size and your IP address can sit in server logs. A file called "divorce-settlement-final.pdf" says a lot on its own.
• Jurisdiction: a file stored in another country falls under that country's rules on who may ask to see it.

How to check whether a tool uploads your file

You do not have to trust a website's description of itself. Every desktop browser can show you what the page sends, and an upload of a whole document is easy to spot because it is about as large as the file itself.

1. Open the tool in Chrome, Edge or Firefox on a computer.
2. Press F12 (or Cmd+Option+I on a Mac) to open the developer tools, then choose the Network tab.
3. Clear the list with the no-entry button, so you only see what happens next.
4. Add a test file you do not mind sharing and run the tool.
5. Look down the Size column, or sort by it. An upload shows up as a request, usually marked POST or PUT, roughly as large as your file. A tool that works in your browser makes no such request: you may see small requests for the page's own code, but nothing the size of your document.

Do this once with a harmless file, before you trust the tool with a real one. It takes a minute and it answers the question better than any privacy page can.

Tools that work in your browser

Modern browsers are fast enough to merge, split, compress and convert PDFs on your own computer or phone. A tool built this way downloads its code once, then reads your file from your disk, changes it in the browser tab and hands the result straight back. The file is never sent to the company's servers, so there is no copy there to keep, leak or hand over.

All PDF works this way: we never upload your file. It is worth being precise about what that promise covers. It means the tool does not send your document anywhere. It does not mean nothing else runs on the page: like most free sites, ours is meant to carry advertising and counts visits, and those scripts run in the same tab. They are never given your files. If you want the strictest setup for a very sensitive document, use a desktop program while offline.

Which files deserve extra care

Treat anything with an identity number, a signature, bank or salary details, health information, a legal matter or someone else's personal data as sensitive. For those, use a tool that works in your browser or a program on your own computer, never a site that uploads. If you need to send the finished file to someone, add a password to the PDF first and give them the password by a different route, such as a phone call or a text message.

For everyday files such as a brochure, a public form or a ticket, an uploading tool from a well-known company is a reasonable trade. The point is to choose on purpose rather than by habit.

A quick checklist before you use any PDF site

• Does it upload? Check the Network tab once with a harmless file.
• If it uploads, does it say how long files are kept, and is that short?
• Does it ask you to install software or an extension? Leave.
• Does it ask you to sign up just to download the result? You are paying with your email address.
• Is the address the one you meant to visit, over https? Look-alike domains are common for popular tools.