Are online PDF tools safe? How to check where your file goes

"Is it safe?" is the right question to ask before you drop a payslip, a medical report or a scan of your passport into a website. The answer depends less on the site's promises than on where the file physically goes. Some online PDF tools send your file to a server; others do all the work inside your browser tab. This guide explains the difference, shows how to check it yourself in a few minutes, and lists what to do before you share a sensitive PDF with anyone.

Two kinds of online PDF tools

An upload-based tool works like email with an attachment. Your browser sends the file over the internet to the company's servers, software there does the work, and you download the result. For a while your document exists on someone else's computer, and what happens to it during that time is governed by their policy and their security.

An in-browser (client-side) tool sends you the software instead. The page downloads a JavaScript or WebAssembly program, your browser reads the file from your disk into memory, the program processes it on your own device, and the result is saved straight back to your downloads. The website never receives the document. When you close the tab, the copy in memory is gone.

	Upload-based	In-browser
Where the file is processed	On the provider's server	On your own device
Who could, in principle, access it	The provider, its hosting companies, anyone who breaches them	Anyone with access to your device
What you rely on	Their retention and deletion policy	The page's code not sending the file anywhere
Typical strengths	Heavy jobs such as Office conversions that need server software	Merging, splitting, editing, compressing, signing, OCR
Speed with large files	Limited by your upload speed	Limited by your device's memory and processor

Neither model is automatically unsafe. A well-run conversion service that deletes files promptly can be a reasonable choice for a restaurant menu or a school newsletter. But for an identity document, "never left my computer" is a much stronger guarantee than "deleted after processing", and it is worth knowing which one you are getting.

How to check for yourself in Chrome

You do not have to take any site's word for it. Every desktop browser includes developer tools with a network log that lists every request the page makes. Google's Chrome DevTools documentation covers the panel in detail; here is the short version for this purpose.

1. Open the PDF tool's page.
2. Press Ctrl+Shift+J (Cmd+Option+J on a Mac) to open DevTools, then click the Network tab. DevTools only records while it is open, so open it before you add your file.
3. Click the clear button (the circle with a line through it) so the list is empty.
4. Add a test file, ideally a harmless PDF of a recognisable size, say 3 MB, and run the tool.
5. Watch the new rows. Right-click the column headers and turn on Domain and Method if they are not shown. The Size column shows how much was transferred.
6. Click any request with the method POST or PUT and open its Payload tab. An upload of your document shows up as a request carrying roughly the size of your file, often labelled as form data with a file field.

You can type domain: followed by a host name into the Filter box to show only requests to one site, which helps on pages that load a lot of advertising.

How to check in Firefox

1. Open the tool's page and press Ctrl+Shift+E (Cmd+Option+E on a Mac). Mozilla's documentation lists this as the shortcut that opens the Network Monitor directly.
2. The monitor starts recording when it opens. It is cleared every time the page reloads, so do not reload after adding your file.
3. Run the tool on a test file.
4. Check the Method, Domain and Transferred columns. Type a host name into the Filter URLs box to narrow the list.
5. Click a POST request and open the Request tab in the side panel to see what was sent.

Reading what you see

• Downloads are normal. In-browser tools fetch their libraries when you first use them, so you will see GET requests to code hosts such as a CDN. Those bring software to you; they do not carry your file away.
• Ads and analytics are normal too. They make small requests measured in kilobytes. A 3 MB document cannot hide inside them.
• A large outgoing request is the giveaway. If your file is 3 MB and a POST of about 3 MB goes to any domain, the file was uploaded.
• The offline test. For a second check, load the tool, let it fetch its libraries by running it once on a test file, then disconnect from the internet and run it again. If it still works, the processing is local.

This is a practical check, not a security audit. A determined site could send data later or break it into small pieces. But for the question most people care about, "did my file just go to a server?", the network log gives a direct answer.

Which PDFora tools run locally and which upload

Most PDFora tools run entirely in your browser: merge, split, organise, rotate, compress, edit, fill and sign, watermark, page numbers, crop, resize, metadata, flatten, remove annotations, PDF to images, OCR, Protect PDF and Unlock PDF among them. If you watch the network log while using them, you will see the libraries arrive from a code host and nothing large leave. OCR downloads its recognition engine and language data when it starts, so allow for that if you try the offline test.

Seven conversions need server software that cannot practically run in a browser: PDF to Word, PDF to Excel, PDF to PowerPoint, and Word, Excel, PowerPoint and HTML to PDF. For these, PDFora's relay starts a job with the conversion provider CloudConvert, your file is uploaded over HTTPS, converted, returned to your browser, and deleted after processing. In the network log you will see requests to PDFora's conversion endpoint and an upload to CloudConvert's storage. CloudConvert's own privacy policy says uploaded files are deleted automatically within 24 hours at the latest, and that servers for most users are in Germany, with US servers used for visitors in the US.

So if you do not want a document to leave your device at all, avoid those seven tools for it.

What to look for in a privacy policy

When a tool does upload, its privacy policy is the only description you get of what happens next. Read it for specifics, not reassurance.

Question	Good answer	Warning sign
How long are files kept?	A stated limit, such as "deleted after processing" or "within 24 hours"	No time given, or "as long as necessary"
Can I delete my file myself?	A delete button, or deletion when the job ends	Only by emailing support
Where are servers located?	Named countries or regions	Not mentioned at all
Who else handles the file?	Named processors and hosting providers	"Trusted partners", unnamed
Is the content used for anything else?	Explicitly not viewed, analysed or used for training	Vague rights to "improve our services" using your content
Is the connection encrypted?	HTTPS for every transfer	Silence, or any plain HTTP page

Location matters because the law that applies to stored data generally follows where it is stored and who stores it. If your employer or a regulation requires data to stay in a particular region, an upload to an unknown location may break that rule even if nothing bad ever happens to the file.

Extra care for IDs, medical and financial files

Passports, national ID cards, bank statements, tax returns, payslips and medical records carry information that is useful to fraudsters and impossible to change once leaked. For these files:

• Prefer tools that process the file on your device, and confirm it with the network log the first time you use a new site.
• Avoid uploading them to any service that is vague about retention or location.
• Work on a copy, and delete intermediate files from your downloads folder when you are done.
• Do not use cropping, white boxes or black rectangles to hide numbers. Cropping only hides the edge of the page, and a shape drawn over text leaves the text underneath, where it can still be selected and copied. If something must not be seen, remove it in the source document, or rasterise the page so that what remains is only an image of what you can see.
• Send only the pages that are needed. A landlord asking for proof of income rarely needs every page of a bank statement.

Clean the file before you share it

A PDF can reveal more than its pages show. Before a sensitive document goes out, run through these steps.

1. Check the metadata. Open Document Properties in your reader. The Author field frequently holds a full name, and the Title can be an old file name. Edit Metadata replaces the Title, Author, Subject and Keywords in your browser. Note that it only overwrites fields you fill in, so to replace a name you type a neutral value, such as your organisation's name; an empty field keeps the old value. The tool also records itself as the producing software. Some PDFs keep a second, XML-based copy of these details (XMP), and the tool leaves that copy alone, so check the result in your reader.
2. Start clean if the source is an Office file. Word, Excel and PowerPoint have a Document Inspector under File > Info > Check for Issues > Inspect Document, which Microsoft describes as removing properties such as author, subject and title along with comments and hidden content. Running it before you export to PDF stops the information from reaching the PDF in the first place.
3. Remove comments. Review notes often include reviewers' names and candid remarks. Remove Annotations deletes comments and highlights from every page. It also removes links and form fields, because a PDF stores those as annotations too.
4. Flatten filled forms. A filled form keeps each answer as an editable field. Flatten PDF draws the answers into the page and removes the fields, so nobody can change a value after you send it. Keep the fillable original for yourself.
5. Protect it if it travels by email. An open password set with Protect PDF encrypts the file with AES-256 in your browser. Send the password by a different route, such as a text message, not in the same email.

None of these steps makes a document anonymous on its own. But together they cover the details people most often send without realising: a name in the Author field, a colleague's comment in the margin, and a form someone else can quietly edit.