Privacy
Are Online PDF Tools Safe? A Privacy Checklist
7 min readUpdated October 7, 2026By the PDF Studio team
When you drop a contract or an ID scan into a website, where does it go? The honest answer is: it depends on the tool. Some online PDF tools process the file entirely in your browser; others upload it to a server; some send extracted text to a third-party AI service. This guide shows how to find out which is which and how to decide what is safe to process.
Three ways online PDF tools work
- In your browser. The page downloads code that runs on your own device. Your file is read and processed locally and is never transmitted. Merging, splitting, rotating, signing, and many conversions can all work this way.
- On the provider’s server. Your file is uploaded, processed remotely, and returned. Some tasks — such as OCR or PDF/A conversion — are heavy enough that providers run them on servers.
- Via an AI service. Text from your document is sent to a language model run by another company to summarize, translate, or answer questions about it.
None of these is automatically “bad”, but they carry different risks, and a trustworthy site tells you plainly which one applies.
How PDF Studio handles it
Most PDF Studio tools run entirely in your browser; the file is not sent to us. The exceptions are listed in our Privacy Policy:
- OCR PDF uploads the PDF to our server (up to 30 MB and 50 pages) for text recognition.
- PDF to PDF/A uploads the PDF to a temporary folder for conversion; the files are deleted as soon as it finishes.
- HTML to PDF, in “From URL” mode, sends the address you enter to our server, which downloads that public page.
- The eight AI tools send the extracted text (not the PDF file) through our server to an AI provider, Groq.
We do not keep your files or text, and there are no accounts. That is a description of our code, not a promise that nothing can ever go wrong — which is why the checklist below is useful for any site.
Check it yourself in two minutes
You do not have to take any website’s word for it. Your browser can show you what it sends:
- 1Open the tool page, then open your browser’s developer tools (press F12, or right-click and choose Inspect) and go to the Network tab.
- 2Click the clear button (a circle with a line through it) so the list is empty.
- 3Add a test file and run the tool.
- 4Look at the list for requests that send data out — especially ones marked POST — and check their size. If a request roughly the size of your file leaves your device, the file is being uploaded. If you see only small requests or none, it was processed locally.
A privacy checklist for any PDF tool
- HTTPS. The address should start with https:// and show the padlock.
- A clear privacy policy that names which tools upload data, what is kept, and for how long. Vague “we may process your files” language is a warning sign.
- No account required for simple tasks. If a site demands sign-up just to merge two files, ask why.
- Honest limits. Be wary of sites promising “100% secure” or “military-grade” anything.
- Third parties named. AI features and analytics should be disclosed.
- Downloads are yours. The result should download directly without being held for a paid upgrade.
What should never go through a web service
Even with a careful provider, some documents deserve extra caution: government ID scans, medical records, signed legal agreements, unreleased financial results, documents covered by confidentiality or professional-secrecy obligations, and anything containing other people’s personal data that you are not authorized to share.
For those, prefer browser-only tools (and verify with the Network tab), or use offline software on your own computer. Avoid upload-based tools, and avoid AI tools, for such documents. If the document must be shared, protect it with a password first — see how to password-protect a PDF — and remove anything that does not need to be there, as described in how to hide sensitive information in a PDF.