Are online PDF tools safe?

Short answer: most are run by legitimate companies and do what they say. The longer answer is that “safe” depends entirely on how the tool is built, that the difference is invisible unless you look for it, and that for certain documents the distinction matters a great deal.

Two completely different architectures

Free file tools come in two kinds that look identical from the outside — same drag-and-drop box, same download button.

Server-side tools transmit your file to a machine somewhere, process it there, store the result temporarily, and give you a link. This is how most well-known PDF sites work. It is necessary for genuinely heavy operations like OCR, and it is the only way to support very large files reliably.

Browser-side tools run the whole operation in JavaScript inside your own tab. The file is read from your disk into your browser's memory, processed there, and written back out as a download. No server is involved after the page has loaded.

Modern browsers can do a surprising amount of this — merging, splitting and rotating PDFs, resizing and converting images, building PDFs from photos. The limits are your device's memory and the absence of anything needing a large model or heavy computation.

What the risk actually is

It is worth being precise, because the honest risk is neither zero nor dramatic:

• A copy exists outside your control. For the retention window, and potentially in backups, logs or caches beyond it.
• Deletion is a promise, not a verifiable fact. You cannot check, and a company that intends to delete looks identical to one that does.
• Breaches expose documents. Temporary file stores have been left publicly readable through misconfiguration more than once across the industry.
• Download links are often unguessable URLs, not authenticated. Anyone holding the link can fetch the file until it expires.
• Compliance rules may prohibit it outright, regardless of the provider's practices — many employers treat uploading company documents to third-party services as a data-handling violation, and rules covering health, legal and financial records are stricter still.

How to tell which kind you are using

You do not have to take anyone's word for it. Three checks, in increasing order of certainty:

1. Watch the network. Press F12 to open developer tools, go to the Network tab, and add your file. A browser-based tool shows nothing new. An uploading tool shows a large POST request roughly the size of your document.
2. Go offline. Load the page, then disconnect from the internet or switch on airplane mode, then run the operation. A browser-based tool works normally. An uploading tool fails at once.
3. Watch for a progress bar that scales with your connection. If a 50 MB file takes noticeably longer on hotel Wi-Fi than on fibre, it is being transmitted. Local processing speed depends on your CPU, not your connection.

The offline test is the most conclusive and takes ten seconds.

When it genuinely matters

Proportionality is reasonable here. Merging two pages of a restaurant menu is not a security decision. These are the cases where it is:

• Identity documents — passports, driving licences, national ID cards, and the photos and signatures submitted with applications. These are precisely what identity fraud requires.
• Financial records — bank statements, tax filings, payslips, invoices with account details.
• Medical documents, which in many jurisdictions carry legal handling obligations regardless of your personal comfort level.
• Legal and commercial material — contracts, anything under NDA, unfiled patent material, due-diligence documents.
• Anything belonging to your employer, where the decision may not be yours to make.
• Other people's personal data — a spreadsheet of customer details, a class list, an HR file. You are making a decision on their behalf.

Things that don't tell you what you think

HTTPS is not the same as private. The padlock means the transfer is encrypted in transit. It says nothing about what the server does with the file once it arrives. Every uploading tool has HTTPS.

“Files deleted after 1 hour” describes an intention. It is probably accurate. It is also unverifiable, and it does not cover backups, logs, or what happens if the company is acquired or breached.

A well-known brand reduces some risks and not others. A large company is more likely to have real security practices and more likely to be a target, and its retention policies are frequently longer, not shorter.

“We don't look at your files” is about people, not systems. Automated processing, indexing and logging are routine and are not what that sentence denies.

A practical policy

You do not need to be absolutist about this. A reasonable approach:

• For anything on the sensitive list, use a browser-based tool or desktop software. Verify with the offline test the first time you use a new site.
• For ordinary documents, an uploading tool is a fine trade for convenience — prefer ones that are clear about retention.
• When a document belongs to someone else or to your employer, follow their rules rather than your own judgement.
• Where the operation genuinely needs a server — OCR, heavy compression, format conversions browsers can't do — accept that and choose the provider deliberately rather than clicking the first search result.