Does This PDF Website Upload My Files? How to Check in 30 Seconds

You need to send a PDF somewhere: an exam form, a visa application, a loan document. You search “compress PDF”, click the first result, and drop in a file that contains your name, address, ID number and signature.

Where did that file just go?

For most popular PDF websites, the honest answer is: to a server owned by that company. The file is uploaded, processed there, and you download the result. Their privacy policies usually say files are deleted after one to a few hours. You are trusting that this is true, that nothing is logged, and that the server is never breached.

There is another way to build these tools, and you can check which kind you are using in about 30 seconds.

Two ways a PDF tool can work

Server tools send your file over the internet. The heavy work happens in a data centre. This is how most of the big names were built years ago, when browsers were slow.

In-browser tools send the tool to you instead. Your browser downloads the program (usually compiled to WebAssembly) and runs it on your own phone or computer. Your document never leaves the device. PDFToast works this way, and so do a small number of newer tools.

Both look identical on screen. You cannot tell them apart from the design or the marketing, so test it.

Test 1: the airplane-mode test (anyone can do this)

1. Open the tool page, for example Compress PDF, and wait for it to load.
2. Turn off Wi-Fi and mobile data. On a laptop, switch off Wi-Fi or unplug the cable.
3. Add your file and run the tool.

If it still works and you get your download, the processing happened on your device. A server-based tool will fail with a network error, because it cannot reach its server.

Test 2: watch the network (laptop, 30 seconds)

1. Open the tool page in Chrome, Edge or Firefox.
2. Press F12 (or right-click the page and choose Inspect), then open the Network tab.
3. Add a file and run the tool, and watch the list of requests.

On a server tool you will see a large request appear while your file uploads. It is usually a POST whose size roughly matches your file. On an in-browser tool you will see the page’s own program files load (scripts and .wasm files) and no request that carries your document.

Tip: sort the Network list by Size. An upload of a 3 MB PDF shows up as a 3 MB request going out.

What to look for in a privacy policy

If you cannot run the tests, read the policy for these phrases:

Phrase	What it usually means
“Files are deleted after 1 hour / 2 hours”	Files are uploaded and stored for that long
“Encrypted in transit (TLS/SSL)”	The upload is protected on the way, but the file still reaches the server
“Processed locally” / “never leaves your device”	Processing happens in your browser (verify with Test 1)

Which documents deserve extra care

Be careful with anything that could be used for fraud or identity theft:

• ID documents: Aadhaar, PAN, passport, driving licence
• Bank statements, salary slips, tax returns
• Contracts, medical reports, school marksheets with dates of birth

For these, use an in-browser tool. If you need to share a document but hide part of it, redact it first. Covering text with a black box in an image editor is not enough, because the text underneath can often still be copied.

The short version

• Most free PDF sites upload your file. That is not automatically bad, but you are trusting them.
• You can check any tool in 30 seconds: go offline and try it, or watch the Network tab.
• For ID and financial documents, prefer tools that work offline.

Every tool on PDFToast passes both tests. Try it with Merge PDF or Compress PDF, and switch your Wi-Fi off first.