Are online PDF tools safe? A privacy checklist

Two kinds of online PDF tools

• Server-based tools upload your file to their servers, process it there and let you download the result. This allows heavy processing such as high-fidelity conversion or OCR, but your document now exists on someone else's computer, at least for a while.
• Browser-based tools send the program to your browser instead, and the file is processed on your own device. Nothing is uploaded. Our PDF to Word, Merge and Split tools work this way.

Neither is automatically unsafe. Reputable server-based services use encryption and delete files after a short period. But with a server-based tool, you're trusting their policies; with a browser-based one, there's nothing to trust because the file never leaves.

How to check whether a tool uploads your file

1. Read the privacy policy for what happens to uploaded files and how long they're kept.
2. Try it offline: open the tool and process one harmless test file (some browser-based tools download their processing engine the first time you use them). Then disconnect from the internet — turn off Wi-Fi — and process a second test file. If it still works, the processing happens on your device.
3. Watch the upload: in your browser's developer tools (F12 → Network tab), process a file and look for a request roughly the size of your PDF being sent out.
4. Watch for account prompts — being asked to sign in or share an email just to download a result usually means files are stored server-side.

Documents that deserve extra care

• ID documents, passports and driver's licenses
• Bank statements, payslips and tax returns
• Medical records and insurance claims
• Contracts, legal documents and anything under a confidentiality agreement
• Documents belonging to your employer or clients, which may be covered by company policy or data protection law

For these, prefer tools that run on your device: built-in apps like Preview or Word, desktop software, or browser-based tools that don't upload. If you must use a server-based service, choose one with a clear deletion policy.

Hidden information inside PDFs

Privacy isn't only about where the file goes — it's also about what the file itself reveals:

• Metadata: author name, the software used, and creation and modification dates. Check it in your viewer's document properties (for example, Ctrl+D in Acrobat Reader).
• Comments and annotations that may be collapsed or hidden in some viewers.
• Covered-up text: drawing a box over text doesn't delete it — the text can still be selected and copied. See the redaction warning in how to edit a PDF.
• Earlier versions: some editors save changes by appending them to the file, so earlier content can remain inside it. Exporting a fresh PDF from the source document avoids this.
• Attachments and form data embedded in the file.

Passwords and protection

PDFs can have two kinds of passwords. An open password encrypts the file so it can't be read without it. A permissions password only restricts actions like printing or copying, and many tools ignore it. If you need to protect a document, use an open password and share it through a different channel than the file itself.

Note that many tools, including ours, can't process a password-protected PDF until you open it with the password and save an unprotected copy — do that only on your own device.

Privacy checklist before using any PDF tool

1. Is this document sensitive? If yes, prefer a tool that runs on your device.
2. Does the tool upload the file? Check the policy or test it offline.
3. Remove pages that aren't needed before sharing (split the PDF).
4. Check metadata, comments and anything covered with boxes.
5. Delete downloaded copies you no longer need from shared or work computers.

Steps and menu names can change between software versions; if something looks different on your device, the same option is usually nearby. How we write our guides.