Is it safe to upload documents to an online converter?

You have a PDF to merge and there are a hundred free websites that will do it. Most are run by people with no interest in your document. Some are not. And if you ask "is it safe?", the honest answer is that you cannot tell which is which from the outside.

What happens when you upload a file

Whatever the marketing says, the mechanics are the same everywhere:

1. Your file is transmitted over the network to a server you do not control.
2. It is written to that server's disk. It has to be, so it can be processed.
3. A program opens it, does the work, and writes a result.
4. You download the result.
5. At some later point, a cleanup job deletes both.

Between steps 2 and 5 your document exists, in full, on someone else's computer. The privacy policy describes what they promise to do during that window. A promise is all it is. Nothing in the system forces them to keep it.

Reading the policy properly

"Files are deleted after one hour." Deleted from where? Application storage, usually. Backups run on their own schedule. Object storage keeps deleted-object versions. Logs record filenames, and the filename is often the most sensitive part of a document.

"We do not look at your files." Probably true of the staff. Says nothing about automated processing, which is not "looking" by any definition they are using.

"Encrypted in transit and at rest." In transit means HTTPS, which every site should have anyway. At rest means the disk is encrypted. That protects against someone stealing the physical drive, and against nothing else. The service still holds the key and still reads your file in the clear to process it.

"We may share data with service providers." Your file may be on infrastructure belonging to companies never named on the site.

None of this means any particular service is acting badly. It means the policy cannot give you the assurance you are looking for, because the architecture requires them to have your file.

When the answer is simply no

For some documents you do not need to weigh the risk at all. A rule already covers you.

• Client documents under professional privilege. Legal and accounting bodies treat third-party disclosure as a breach regardless of intent.
• Anything with health information. Under HIPAA a processor is a business associate and needs an agreement. A free website has not signed one.
• Personal data on EU residents. GDPR makes you the controller and the site a processor. You need a lawful basis and a data processing agreement.
• Anything under NDA. Most NDAs prohibit disclosure to third parties without written consent. Uploading is disclosure.
• Payroll, HR files, board papers, unreleased financials. If leaking it would be a story, do not upload it.

People break these rules constantly, and almost always without realising a rule was involved. Merging two PDFs does not feel like transmitting confidential data to a foreign jurisdiction. Technically, that is exactly what it is.

The alternative: do not transmit it at all

Browsers have been able to do this work locally for years. The File API reads a file from disk into the page's memory. WebAssembly runs a real PDF engine at close to native speed. The result is written back out as a download. At no point does the file touch a network.

This is how every tool on this site works. It is built that way, so you do not have to rely on a policy. There is no upload endpoint. There is no server that could receive your document if we wanted one to.

How to verify that claim

Do not take our word for it. Any of these will settle it in under a minute:

1. Disconnect. Load a tool page, turn off your wi-fi, then use the tool. It works. Nothing that requires a server can do that.
2. Watch the network. Open your browser's developer tools, go to the Network tab, and run a conversion. You will see the page and its scripts load. You will not see your file go anywhere.
3. Read the source. It is JavaScript delivered to your browser. It is all there to inspect.

Point three works on any site, not just this one. If you are evaluating a converter you have not used before, the Network tab tells you what its privacy policy will not.

If you must use an upload-based service

• Redact the sensitive parts first. Do it properly, so the text is removed and not just covered.
• Strip identifying detail from the filename. Logs keep filenames long after files are gone.
• Use it for the least sensitive document that will accomplish your goal.
• Check whether your employer has an approved tool. Usually there is one, and usually nobody mentions it.

The three ways a file tool can work, compared

Every converter, compressor and merger on the web is one of three architectures. The marketing rarely says which, but the answer decides everything about confidentiality.

How it works	Where your file goes	Size ceiling	Works offline	Right for
Upload to a server	Across the network, onto a disk you do not control, until a cleanup job runs	Set by the service, often 10–100 MB free	No	Files you would happily email to a stranger
Runs in the browser	Nowhere. It is read from disk, processed in the tab, written back	Your device's memory	Yes, once the page has loaded	Anything confidential, and anywhere uploads are forbidden
Installed program	Nowhere, unless it syncs or phones home	Your disk	Yes	Repeated bulk work, and formats a browser cannot open

The middle row gives you the privacy of the desktop program and the convenience of the website. It does give up two real things: nothing is kept, so there is no history and no shareable result link, and a very large file can exhaust the tab's memory where a server with 64 GB would not have blinked.

How to tell which one you are looking at, in under a minute

1. Open the network panel in your browser's developer tools (F12), then run the tool on a small test file. A large outgoing request as you press the button means an upload. No outgoing request means the work happened locally.
2. Load the page, turn off your network, then run the tool. A browser tool finishes. An upload tool cannot.
3. Look for a result link you can send to somebody. If one exists, the file is on a server, because a link has to point at something.
4. Read what happens on failure. "Your file is queued" and "server busy" are only possible when there is a server.

Test 2 is the one I would trust most. A privacy policy is a promise about behaviour. A tool that keeps working with the network switched off has shown you how it is built, and no wording can undo that.

The short version

If you would not email the document to a stranger, do not upload it to one. For most everyday jobs, like merging, splitting, compressing or converting, you no longer have to choose. The work runs perfectly well on the machine that already holds the file.