PDF privacy: what you are actually uploading when you use an online tool
Documents people convert online are often the most sensitive ones they own: payslips, medical letters, contracts, passports. It is worth knowing where they go.
Last updated September 2026
Privacy · 7 min read
Server-side versus browser-side processing
Most online PDF tools upload your file to a server, process it there, and give you a download link. Your document sits on infrastructure you do not control, for a retention period set in a policy you probably did not read, and it travelled across a network to get there.
Browser-based processing is a different model. The page loads code that runs on your own machine, and the file never leaves it. You can verify this: open your browser's developer tools, switch to the Network tab, and run a conversion. No upload request means no upload. PDFTools works this way for every tool.
Questions worth asking about any tool
- Where is the file processed, and does the privacy policy say so explicitly?
- How long are files retained, and is deletion automatic or on request?
- Is the download link guessable, or does it require a session?
- Is the connection HTTPS end to end?
- Does the service claim any licence over uploaded content in its terms?
Metadata: the part people forget
PDFs carry hidden fields: author name, the software used, creation and modification timestamps, and sometimes the original file path — which can expose a username or an internal project name. Scanners may add device identifiers. None of it is visible on the page, all of it travels with the file.
Before sending a document outside your organisation, check the document properties in your PDF reader and clear anything you would not want read aloud.
Redaction is not a black rectangle
Drawing a filled box over text hides it visually while leaving the text underneath fully intact and copyable. This has caused real-world leaks in court filings and government releases repeatedly. True redaction removes the underlying content.
If you have no redaction tool, the reliable workaround is to remove the text and then flatten the page to an image, so nothing remains beneath the mark. Verify by trying to select the redacted area afterwards and by searching the document for the removed word.
Password protection, honestly
PDF passwords come in two kinds. An owner password merely sets permission flags — printing, copying — which many readers ignore; it is a request, not a lock. A user password encrypts the file and is genuinely effective with modern AES encryption and a strong passphrase. Send the password through a different channel from the file itself.