Are online PDF tools safe? What actually happens to your file

Two architectures, one honest question

Every “online PDF tool” belongs to one of two families, and the difference is the whole story:

• Upload-based tools send your file to the company's server, process it there, and hand back a download link. The website is a counter; the work happens in the back room, on their hardware.
• In-browser tools ship the machinery to you instead: the splitting, merging and compressing runs as code inside your own browser tab, on your own computer. The file is opened locally and never transmitted anywhere.

Both look identical — a webpage with a “choose file” button. Only the plumbing differs, and the plumbing is what decides whether your document existed on somebody else's disk this afternoon.

What “uploaded” actually implies

Upload-based services are not villains — reputable ones state a retention window (commonly “deleted after one hour”) and mostly honour it. But be precise about what you accept when uploading: your document existed, in full, on infrastructure you can't inspect, subject to that company's security, its staff policies, its logging, its legal jurisdiction, and its honesty. For a flyer, nobody cares. For the documents PDF tools most often touch — the signed lease, the salary slip, the passport scan for “verification” — you are extending real trust to an anonymous website, in exchange for saving a few seconds.

How to tell which kind you're using

Some checks anyone can do, no expertise needed:

1. Read the tool's own claim. Phrases like “files never leave your device” or “processed in your browser” describe the in-browser design; “files deleted after X hours” tells you there was an upload to delete.
2. The airplane test. Load the tool's page, disconnect from the internet, then process a file. An in-browser tool keeps working — the work is local, so the network isn't needed. An upload tool fails immediately.
3. Watch the network tab. For the technically curious: open the browser's developer tools (F12 → Network), run the operation, and look for a request carrying megabytes up. In-browser tools show page assets downloading and nothing meaningful uploading.
4. The file-size tell. A 200 MB PDF that starts processing instantly on a normal connection wasn't uploaded anywhere — there wasn't time.

The rest of the checklist

Architecture is the big question; a few smaller ones round out the picture. Is the connection HTTPS (it should be, universally, even for in-browser tools — it protects the page code from tampering)? Does the site have a real privacy policy and a named operator, or is it anonymous? Is it honest about how it makes money — visible ads, a paid tier — rather than mysteriously free? A site with nothing to hide typically hides nothing.

Where we stand, stated plainly

This site is the in-browser kind, and it is the reason Orb2Bit PDF exists: all sixteen tools — split, merge, compress, redaction and the rest — run inside your tab, and your files never leave your machine. You can hold us to that with the airplane test above, today. The same design carries through the Android app and the Windows app, which process documents on the device itself.

One honest boundary: features that inherently need a network say so. Our Translate tool, for instance, must send the page text (never the file) to a translation service to translate it — the tool tells you this before you use it. That is the standard worth demanding anywhere: local by default, and clearly labelled on the rare occasion it can't be.

The rule of thumb

Match the tool to the document. Public flyer? Use anything. Contract, payslip, anything with your ID on it? Use a tool that keeps the work on your device — or at minimum, one that names its retention window and its operator. The few seconds “saved” by not checking are never worth wondering, later, where a copy of your lease might be.

Keep reading