Most online PDF tools are not safe for sensitive documents — because nearly all of them upload your file to their servers first, process it there, and promise to delete it later. Your contract, medical record or bank statement is transmitted, stored, and exposed to breaches and legal requests in between. The safe alternative is a tool that never receives your file at all: every tool on this site runs 100% in your browser, so your document never leaves your device. Here is exactly what happens to your file with each approach.
Updated 19 October 2026
Take the standard flow at Smallpdf, iLovePDF, Adobe's web tools or Sejda:
This is not a conspiracy theory; it is how server-side processing necessarily works. The companies are mostly legitimate and mostly careful. But careful is not impossible to breach, and the file being on their servers at all is a risk you take for every document — including the ones that define your financial and legal life.
Nobody worries about uploading a public flyer. The risk concentrates in the documents that get processed most often:
These are precisely the documents where "we delete after an hour" is not good enough — because an hour of exposure is all a breach needs, and you have no way to confirm the deletion happened.
Compare the two designs side by side:
You don't have to take our word for it. Open developer tools (F12) → Network tab → drop a file into any tool on this site and run it. You will see page assets loading and nothing else — no upload request, no payload carrying your document. Run the same test on a server-based tool and watch megabytes leave your machine. That single observation settles the question more reliably than any privacy policy ever will.
The GDPR angle makes the difference concrete: uploading a document with personal data to a third party is a data transfer under EU law, with processor agreements and lawful-basis obligations attached. When the file never leaves the device, no transfer occurs — the compliance question dissolves instead of being answered with paperwork.
Everything below runs the browser-only architecture. Chain them without your file ever touching a server:
Read our full privacy policy — it is short, because there is almost nothing to collect when files never arrive.
Honesty cuts both ways. Uploading is harmless when the document is not sensitive: a public brochure you want compressed, a slide deck that is already published, a scanned menu. Server tools also offer features browser tools can't match — real OCR, heavy batch processing, certified e-signatures. Use them for public documents; keep the private ones on your device. The rule is simple: if you wouldn't email it to a stranger, don't upload it to a stranger's server.
It depends on the architecture. Most free online PDF tools upload your document to their servers, process it there, and promise to delete it afterwards — your file is exposed to transmission, storage, breaches and legal requests in between. Browser-only tools like the ones on this site do the work in JavaScript on your device, so the file never leaves it. That design is safe by construction, not by promise.
Most say they delete files after a window — commonly 1 to 24 hours. But "deleted from the web app" is not the same as "gone": backups, logs and caches can retain copies, and you have no way to verify deletion. A tool that never receives your file has nothing to delete.
It is the highest-risk thing most people do with PDF tools. Bank statements and tax returns contain account numbers, balances, national ID numbers and addresses — exactly the data identity thieves want. Use a browser-only tool that never uploads the file, so the document is never exposed.
Yes, in under a minute. Open your browser's developer tools (F12), go to the Network tab, drop a file into the tool, and run the job. If you see large upload requests carrying your document, it uploads. If you see nothing but tiny page assets, it processes locally — like every tool on this site.
Both are legitimate companies with encryption and deletion policies — but both process your file on their servers, which means the un-redacted, un-compressed original is transmitted to and stored on infrastructure you don't control. For confidential documents, a no-upload tool is strictly safer than any server-based tool, regardless of its policies.
Uploading a document containing personal data to a third-party server is a data transfer under GDPR — the tool becomes a data processor, and you are responsible for having a lawful basis and appropriate safeguards. Browser-only processing sidesteps the question elegantly: if the file never leaves the user's device, no transfer occurs.
Use a tool that (1) never uploads the file and (2) truly destroys the hidden content instead of covering it with a black layer. Our redact tool does both: everything runs in your browser, and pages are re-rendered with the black boxes burned into the pixels, so the original text no longer exists in the output file.
Strip hidden author/title/software data — see it first, 100% in your browser.
Open tool →