Many websites that compress, merge or convert PDFs work by uploading your file to their servers. That may be fine for a restaurant menu, but not for a tax return, a client file or a passport scan. Privacy policies help, but you do not have to take any website’s word for it: you can check what your browser actually does.
Why it matters
When a document is uploaded, a copy exists — at least temporarily — on equipment you do not control. It may be logged, cached, backed up, inspected for abuse, or processed in another country. A tool that works entirely in your browser avoids all of that, because the file never leaves your device.
Test 1: switch off your internet connection
This is the simplest test and needs no technical knowledge.
- Open the tool’s page while you are online and wait for it to finish loading. On Qpdf, wait until the tool shows Ready to work offline.
- Turn off Wi-Fi, or unplug the network cable.
- Select a test PDF and run the tool.
- Download the result.
If the tool produces a correct result while you are offline, it did not need to send your document to a server. If it shows an error, an endless progress bar or a message about your connection, it almost certainly relies on a server.
Use a harmless test file for this check, not a confidential one.
Test 2: watch the Network panel
Desktop browsers include developer tools that list every request a page makes.
- Open the tool’s page.
- Open the developer tools (F12, or Ctrl+Shift+I on Windows and Linux, Cmd+Option+I on a Mac) and select the Network tab.
- Clear the list, then select a test PDF and run the tool.
- Look at the requests that appear. Pay attention to any request using the POST or PUT method, and to the size of data sent. An upload of a 5 MB PDF shows up as a request carrying roughly 5 MB.
Seeing only small downloads (scripts, WebAssembly files, fonts) while the tool runs is what you would expect from a local tool. A large outgoing request around the time you pressed the button is a clear sign of an upload.
What these tests do and do not prove
These checks show whether the tool needed to upload your file for the job you tested. They are good evidence, but they are not a full security audit. A site could, in theory, behave differently another day or for another tool, and nothing a website does can protect a device that is already compromised. For very sensitive work, repeat the test with the exact tool you plan to use, keep your browser up to date, and avoid browser extensions that can read every page you visit.
Other warning signs
- Upload progress bars. “Uploading… 45%” means exactly that.
- Small file-size limits. Strict limits are often there because the provider pays to store and process your files.
- Accounts for basic tasks. Requiring a sign-in to compress one file suggests files are tied to an account on a server.
- Vague policies. Phrases such as “files are deleted after a few hours” confirm that files were stored.
Sources
- Inspect network activity — Chrome for Developers
- Network Monitor — Firefox Source Docs