Are online PDF converters safe to use?
It is a fair question, and the honest answer is: it depends entirely on where the work happens. Two sites can look identical and treat your document completely differently. Here is how to tell them apart before you hand over a contract, a payslip or a medical letter.
Drag and drop here, or choose from your device.
Up to 50 MB per file. Files are processed in your browser.
Full options and FAQs on the Compress PDF page.
The two kinds of PDF tool
Server-side tools upload your file, process it on their machines and give you a download link. This is how most of the well-known PDF sites work. Your document sits on someone else's infrastructure, typically for a stated retention window, and passes through their logs and backups on the way.
Browser-side tools load the processing code into your browser and do the work on your own device. The file is read from disk by the page, manipulated in memory, and written back out. It is never transmitted.
How to check which one you are using
- Read the privacy policy for the words 'upload', 'retain' and 'delete after'. A deletion promise only makes sense if the file was uploaded in the first place.
- Open your browser's network panel (F12, Network tab) and run the tool. A server-side tool shows a large outgoing request the moment you add a file; a browser-side tool shows nothing.
- Disconnect from the internet after the page loads. A genuinely local tool keeps working. An upload tool fails immediately.
- Be sceptical of file size caps that only make sense as bandwidth limits, and of tools that email you a download link.
When uploading is genuinely a problem
For a holiday photo it does not matter. It matters for anything covered by an obligation you have to someone else: client files under professional privilege, employee records, patient information, unpublished financials, or anything your employer's data policy governs.
In those cases the risk is not usually a dramatic breach. It is the mundane fact that you moved regulated data to a third-party processor without authorisation, which is a compliance problem regardless of whether anything bad ever happens to the file.
Step by step
- 1Decide whether the document contains anything you would not email to a stranger.
- 2If it does, check the tool's privacy policy for upload and retention language.
- 3Confirm with the network panel, or by going offline after the page has loaded.
- 4Prefer a browser-only tool for anything confidential — the question of retention never arises.
- 5For extremely sensitive files, do the work offline in desktop software instead.
Frequently asked questions
- Is HTTPS enough to make an upload tool safe?
- HTTPS protects the file in transit, not once it arrives. The question is what the receiving service stores, for how long, who can access it, and where in the world it sits.
- How do PDF Flourish tools work?
- Everything runs in your browser with JavaScript and WebAssembly. Files are read locally and never transmitted, which is why the tools keep working with the network disconnected.
- Do free tools sell my documents?
- Reputable ones say they do not, and most fund themselves with ads or paid tiers. The point is that you have to take an upload service at its word, whereas with local processing there is nothing to take on trust.