Are Online PDF Tools Safe? What to Check Before You Upload

Online PDF tools are convenient, and the documents we put through them are often private: contracts, payslips, medical reports, ID scans. This guide explains how these tools work, where the risks are, and how to judge any of them.

Two ways an online PDF tool can work

The word "online" hides a big difference. There are two designs, and the privacy picture is different for each.

Upload and process on a server. You choose a file, and the website sends it across the internet to its own computers. Those computers do the work, and then you download the result. This design makes very heavy jobs easy for the provider, but your document leaves your device and sits, at least for a while, on someone else's machine.

Process in your browser. The website sends code to your browser, and that code does the work on your device. The file is read locally and the result is created locally. The document is never sent to the website. This is how iLoveDocuments works.

Neither design is automatically good or bad. A reputable provider with a clear deletion policy can be a reasonable choice. A browser-based tool avoids many of the risks by design. The problems come from unknown sites with no information about what happens to your file.

The real risks of uploading a document

• Retention. Is the file deleted, and when? Some services say within an hour or two. Others say nothing.
• Access. Who at the company can see uploaded files? Is the storage encrypted?
• Reuse. Could the file be used to train a system or analysed for advertising? A good privacy policy says no.
• Breaches. Anything stored on a server can be exposed if the server is attacked.
• Fake sites. Look-alike sites collect documents or push you to download unwanted software.
• Intercepted traffic. A site without HTTPS lets others on the network read what you send.

A checklist for any online PDF tool

1. HTTPS. The address should begin with https and show a lock. Do not use a document tool without it.
2. A clear privacy policy. It should say what is collected, whether files are uploaded, how long they are kept and who can access them. Vague statements are a warning.
3. A real contact. A reachable company or person, with an address or email, is better than an anonymous page.
4. No forced downloads. A web tool should not ask you to install an extension or program to use a simple feature.
5. No account for simple tasks. Merging two files should not need your email, phone number or card.
6. Honest descriptions. Be wary of tools that claim to do everything perfectly. Honest tools describe their limits.
7. Ads that are separate from the tool. If the page is full of fake download buttons that look like part of the tool, leave.

How to check whether a tool really works in your browser

A promise of "no upload" can be tested, and you do not need to be technical.

1. Open the tool page, then open your browser's developer tools (in most browsers, press F12 or right-click and choose Inspect) and go to the Network tab.
2. Clear the list, then choose a file and run the tool.
3. Look at the requests. A browser-based tool shows no large upload of your file. A server-based tool shows a big request (the size of your file) sent to the site.

The tool may still download code libraries when it loads. That is separate from your document. Another quick test is to turn off your internet after the page has loaded and run a simple tool. If it still works, the processing is local. (Some tools fetch a library the first time they run, so load the tool first.)

What iLoveDocuments does, and does not, do

• The tools process your files in your browser, and the files are not uploaded to our servers.
• The code that does the work, including the OCR language data, is downloaded from our own site when a tool first needs it. Your document is not part of those downloads.
• When you use Continue with to pass a result to another tool, the file is kept briefly in your own browser’s storage so the next page can open it, and removed as soon as it is opened (or after 15 minutes).
• We do not ask you to create an account or give an email address to use a tool.
• The site shows advertising from Google AdSense, which may use cookies if you accept them. You can reject advertising cookies. See our privacy policy for the full detail.
• Our contact form does collect what you type into it. Do not put passwords or ID numbers in it.
• We cannot protect your device. If your phone or computer has malware, no website can protect what is on it.

Read how our tools work for the technical description.

Extra care for the most sensitive documents

For documents where a leak would be serious, such as medical records, legal papers or identity documents, add these habits:

• Share the minimum. Extract only the pages you need with Extract PDF pages.
• Hide details that the recipient does not need, using Redact PDF.
• Label the purpose. A watermark reading "For bank loan only" makes reuse harder.
• Use your own device, not a shared or public computer, and clear downloaded files from shared machines afterwards.
• Prefer an offline desktop program for documents that must never touch a network at all.

Our honest view

Browser-based processing is an excellent fit for everyday jobs because it removes the largest risk: your file leaving your device. Modern browsers can do a surprising amount locally, including OCR on this site, but they cannot do everything. For jobs such as PDF/A conversion, translation or batches of hundreds of large files, you may need a server-based service or desktop software. In those cases, choose a provider with a clear deletion policy and delete the file from the service as soon as you can.

Frequently asked questions

Keep reading

• How to Redact a PDF: Black Out Sensitive Information
• How to Merge PDF Files Online for Free (No Upload)

Written by the iLoveDocuments team and checked against how the tools behave today. Spotted a mistake? Tell us and we will fix it. See our editorial standards.