The short version
Stop asking whether the site is trustworthy and start asking where your filegoes. Watch the Network tab while you add the file. Load the page, disconnect from the internet, and see whether the tool still works. Search the privacy policy for an actual number of hours. Find the operator's name and country. Notice whether a one-off job demands an account. Refuse any install prompt. Six answers, five minutes, and you will know more about the tool than any review could tell you.
The checks are deliberately ordered from most to least conclusive. The first two are close to proof; the rest are judgement calls that tell you how much benefit of the doubt the tool has earned. If you want the background on whyan uploaded document carries the risk it does — the systems it passes through, what “deleted” means in practice — read are online PDF tools safe? afterwards. This page assumes you just want to vet the tab you already have open.
Why the tool's name is not the answer
Almost everyone arrives at this question the same way: they type a product name and the word “safe” into a search box. It is a reasonable instinct and a weak method, for three reasons.
First, reputation lags architecture. A tool can be well regarded and still upload your file, and a tool nobody has written about can run entirely on your own machine. The two properties are unrelated, and only one of them is verifiable in a minute.
Second, the answer changes. Sites get sold, rewrite their terms, add an analytics vendor, or move processing from the browser to a server to support a new feature. A forum thread from three years ago is describing a product that may no longer exist in that form.
Third, “safe” is not one question. An honest, well run, legally compliant tool can still be the wrong place for a signed employment contract, while being a perfectly sensible place to compress a public flyer. Safety is a relationship between the tool and the document in your hand: the checks below establish the facts, and the last section helps you weigh them.
Check 1 — Watch the file leave (or not)
Every browser ships a window that shows you exactly what the page sends. Press F12 (or right-click anywhere on the page and choose Inspect), click the tab labelled Network, and leave it open. Now add your file to the tool as normal and watch the list of requests that appears.
You are looking for one thing: a request whose size is roughly the size of your document. Glance at the size column. An uploaded 4 MB PDF produces a request of about 4 MB, usually marked POST, and on a slow connection it takes visible seconds. That request is your file leaving your computer, and nothing else on a normal page is that big.
Nothing large is sent. You see the page's own scripts and images load, then the file processes and the download appears with no outbound request anywhere near your file's size. The work happened locally.
A multi-megabyte upload appears — and the page told you it processes “locally” or “in your browser”. Uploading is not itself a scandal; describing an upload as local processing tells you the copy on the site is unreliable everywhere else too.
Two honest caveats. Judge by size, not by the mere existence of requests — a little harmless telemetry is normal. And a page may legitimately download a large code library on first use: that traffic is inbound, arriving from the site. What matters is a big request going out at the moment you added the file.
Check 2 — Cut the connection
This is the check that needs no developer tools and no interpretation, and it is the one to run if you only run one. Open the tool and let the page finish loading. Then turn off your Wi-Fi, or unplug the cable, or switch the phone to airplane mode. Now use the tool: add your file and produce the result.
The logic is simple enough to trust. If the file had to travel to a server to be merged or converted, and there is no network, the operation cannot complete. When it completes anyway, the code doing the work is running inside your own browser, on your own processor. Nothing was sent, because there was nowhere for it to go.
The tool works normally offline and hands you a correct file. This is the strongest positive signal available without technical skill, and very little else can fake it.
It hangs, spins forever, or shows a network error. Usually that means a server-based tool, which receives a copy of whatever you feed it. Not always, though — a genuinely local tool can fail this test too, because many fetch part of their own engine the first time you use a feature. So treat a failure as a reason to run Check 1, not as a verdict.
We would rather you ran this on us than took our word for anything. Load the PDF merger, let it finish loading, disconnect, then merge two files: the merge itself completes, because the code doing it is JavaScript already running in your tab, and there is no account to sign in to. Being exact about our own caveat, since this page is about not taking claims on faith: the page thumbnails come from a separate script the browser fetches the first time it draws one, so if you disconnect before that happens the previews may stay blank even though the merge still works. And the check in general has to be run after the page has loaded — a first visit obviously needs the network to fetch the page itself. What never appears in a request, online or off, is your document.
Check 3 — Find a number in the privacy policy
If checks 1 and 2 told you the file is uploaded, the next question is how long it exists on the other end. Open the privacy policy and use your browser's find function — Ctrl+F or Cmd+F — for the words delete, retain, hour, and storage. You are hunting for a figure, not a sentiment.
While you are there, search the terms of service for licence or license. Some services grant themselves broad rights over content you process — to store it, adapt it, or use it to improve the service, which can include training machine-learning systems. That clause matters more than the deletion promise, because it describes what the vendor may do with your document.
A specific window you could hold someone to: “uploaded files are deleted one hour after processing”. Plus no licence claim over your content and no mention of using it to train anything.
No privacy policy at all, a policy that never mentions uploaded files, wording like “deleted promptly” with no figure, or a licence broad enough to cover anything the vendor fancies.
Keep the limits of this check in view. A stated window is a promise, not a mechanism: backups, log entries and cached download links can all outlive the file they refer to, and you cannot audit any of it. A specific number is evidence that someone thought about the problem, not evidence that the file is gone.
Check 4 — Who runs it, and where
Look for an About, Imprint, Legal or Contact page and see whether a real entity is named: a company, a registration number, a postal address, a country. Sites operating in the EU are generally required to publish this, which is why an imprint page is such a quick tell.
Jurisdiction matters for a practical reason. A named operator in a country with enforceable data-protection law is a party you could complain to, with obligations that outlive their goodwill. An anonymous site has neither. This check costs thirty seconds and is the one most people skip.
A named legal entity, a location, and a way to reach a human. Bonus marks for a data-processing agreement offered to business users, which is what your employer will ask for.
No operator named anywhere, a contact page that is only a web form, or a policy that mentions no jurisdiction. Combine that with an upload and you are handing a document to nobody in particular.
Check 5 — Does a one-off job demand an account?
Try the tool before you commit to it and notice where it stops you. A wall that appears only at the download step — after your file has already been sent — matters, because by then the leverage has shifted: the site has the document and you have nothing.
An account is not inherently sinister — quotas, billing and saved workspaces are real features. But for a single conversion it changes the shape of the exchange: your file is now linked to your identity in someone's database, and the reason they wanted that link is rarely stated. Ask what the account is for, and whether a simpler tool would do the same job without one.
You can complete the whole job — add file, process, download — without giving an email address or creating anything. PDFGami has no account at all, and plenty of other tools work this way too.
Registration demanded after the upload, an email required to “receive your file”, or a signup form that is clearly the point of the page and the tool is the bait.
Check 6 — Extensions, installers and “open with our app”
This is the only check on the list where the downside is not about your document. A web page, however careless, is confined to its tab. A browser extension can be granted permission to read every page you visit, and a desktop installer runs with your user account's privileges. The gap in blast radius is enormous.
So treat any nudge away from the web page as a step up in commitment. “Install our extension for faster conversions” on a page that was about to merge two PDFs is an unrelated request. Extensions also change hands: one that was harmless when you installed it can be sold and updated, and the update arrives silently under the trust you already granted.
The job finishes in the tab. No installer, no extension, no prompt to change your default PDF handler, no notification permission request for a one-off task.
The web version is crippled until you install something, a download starts on its own, or the result arrives as an executable rather than the file format you asked for. Close the tab.
Adding it up in five minutes
You do not need all six answers for every file. Here is the order to run them in and what each one buys you.
| Check | Time | How conclusive |
|---|---|---|
| Works with the connection cut | 30 seconds | Near proof the file stayed put |
| Network tab shows no big upload | 1 minute | Strong, and shows what else is sent |
| Retention window is a number | 2 minutes | A promise, not a mechanism |
| Operator and country are named | 30 seconds | Tells you who is accountable |
| No account for a one-off job | Instant | Reveals the business model |
| No install or extension prompt | Instant | Caps the worst case at one tab |
A tool that passes the offline and no-installer checks has a worst case bounded by your own browser, and the rest of the list becomes largely academic. Failing the offline check does not make a tool bad — it makes it server-based, and for those the remaining four checks are the whole assessment, because you are no longer judging software, you are judging a custodian.
When uploading is perfectly fine — and when it is not
Half of the internet's advice on this topic is unusable because it treats every document as a state secret. Most files are not sensitive, and for those the convenient tool is the right tool. The test is simple: would you mind if this document ended up somewhere you did not choose?
- A public brochure, menu, flyer or poster.
- A published price list or product datasheet.
- A press release that is already out.
- A recipe, a manual, a map you downloaded.
- Your own holiday photos, if you do not mind them being seen.
- Anything already on a public website.
- Contracts, NDAs, anything signed.
- Passports, ID cards, driving licences, visas.
- Medical letters, test results, prescriptions.
- Payslips, tax returns, bank and brokerage statements.
- Anything covered by an NDA or marked confidential.
- Other people's personal data — customer lists, CVs, school records.
Two things worth remembering about the right-hand column. A document carries more than you can see: author names, earlier revisions, embedded thumbnails and file paths travel with it. And if the file holds other people's data rather than your own, the decision may not be yours to make at all — that is where a data-processing agreement stops being paperwork and starts being the point.
One more shortcut worth knowing: some conversions cannot honestly be done without a server, because the browser has no engine for the format. Office and Apple document formats fall into that category, and a site promising local conversion of them is describing something the browser cannot do. We set out which formats really work locally in which files you can convert online safely. When a format is on the wrong side of that line, exporting to PDF from the app that made it is both the safest and the highest-quality route, and any browser-only tool can then finish the job.
Frequently asked questions
Is it safe to merge PDFs online?
It depends entirely on whether the merge happens on your device or on someone else's computer. A browser-based merger rebuilds the combined PDF locally and nothing is transmitted, which carries roughly the same risk as opening the file in a desktop app. A server-based merger necessarily receives a copy of every page you feed it, so the answer becomes a question about that vendor: how long they keep the file, who can read it, and which law applies. For a public brochure either is fine. For a signed contract, only the local option is defensible.
How do I check whether a specific PDF site is safe?
Run six checks, which take about five minutes together. (1) Open your browser's Network tab and watch whether your file is actually sent. (2) Disconnect from the internet after the page has loaded and see whether the tool still works. (3) Search the privacy policy for a specific retention window, not a vague promise. (4) Find out who operates the site and in which country. (5) See whether a one-off job demands an account or an email address. (6) Note any prompt to install an extension or a desktop program. This page explains what a good answer and a disqualifying answer look like for each.
Are free PDF converters safe for work documents?
Free is not the risk factor; uploading is. A free tool that runs locally never transmits the document, while a paid tool that processes on a server still does. The question for work documents is whether your employer is allowed to hand that file to a third-party processor at all. Many organisations require a data-processing agreement before any external service touches customer data, and free services rarely offer one. If the document would need approval to email outside the company, it needs the same approval to upload.
What is the safest way to convert a file?
Use software already installed on your machine, or a tool that provably runs inside your browser. The single safest route for office documents is the source application's own "Save as PDF" or "Export to PDF", because the file never moves. After that, a browser-based tool that passes the offline check. A server-based converter is the least private option by construction, and is best reserved for material you would be comfortable publishing.
Are PDF mergers safe in general, or does it vary by site?
It varies, and it varies along one axis that matters more than branding: where the work happens. Two sites with identical marketing can have completely different architectures. That is why judging a site by reputation alone is unreliable and why the checks below are worth running on whichever one you are about to use, including a well-known one.
Does HTTPS and a padlock icon mean my file is safe?
No. HTTPS protects the file while it travels, which rules out casual interception on a shared network. It says nothing about what happens once the file arrives and is decrypted at the other end: how long it is stored, who can read it, whether it is logged or used for anything else. A padlock is a minimum, not a verdict. Every site in every example on this page has one.
What does it mean if a PDF tool keeps working with the internet disconnected?
It is the strongest positive signal available to a non-technical user. If you load the page, turn off Wi-Fi, and the tool still merges or converts your file successfully, the work cannot have happened on a remote server, because there was no route to one. The result is being produced by code running in your own browser. PDFGami passes this check: load a tool, disconnect, and it still works.
Should I worry if a tool asks for my email before letting me convert one file?
Treat it as a reason to pause rather than proof of anything. An account requirement for a single one-off conversion means the transaction is no longer just "your file for a result" — the site has a business interest in your identity, and your file is now associated with it. Sometimes that is a legitimate quota system. Sometimes it is lead generation. Either way, a one-file job should not require registration, and plenty of tools do not ask.
Is a paid PDF tool safer than a free one?
Paid vendors usually have clearer privacy commitments, a real legal entity behind them, and an incentive not to monetise your content, which are genuine advantages. But paying does not change the architecture: if the tool processes on a server, the file is still uploaded and still stored for some window. Price tells you about the business model; the Network tab tells you about the data flow. Check the second one.
How can I tell after the fact whether a tool uploaded my file?
You cannot, reliably, once the moment has passed — which is why the checks belong before you drop the file in, not after. What you can do afterwards is read the privacy policy and the terms for a retention window and any licence the service claims over processed content, then assume the file existed on their systems for at least that long. If the document was sensitive, tell whoever owns it rather than hoping the window has closed.
Run the checks on us
Open a tool, disconnect from the internet, and use it. It keeps working, because it runs in your browser in JavaScript — your files are not uploaded, and there is no account.
Continue reading
PDFGami is a browser-based PDF tool suite, so we have a commercial interest in how this question gets answered. We have deliberately written a test you can run on any tool, including ours, rather than a list of names to avoid: a site's behaviour today is the only thing worth judging. No third-party tool is described here as unsafe, and none should be inferred to be.