PDF Tools That Don't Store Your Files
Most online PDF tools upload your files to a server — where they may be stored, analyzed, or breached. Here's how to find and use tools that keep your files off their servers entirely.
Why do most PDF tools store your files?
Most online PDF tools are built on a server-processing model: you upload a file, their server runs the PDF operation (compress, merge, convert, etc.), and the result is sent back to you. This architecture is simple to build and works on any device — but it means your file spends time on their infrastructure.
Typical retention policies range from "deleted immediately after processing" to "kept for up to 7 days." What actually happens in practice is hard to verify.
How to tell if a PDF tool stores your files
There are a few ways to check:
1. Read the privacy policy
Look for language about file retention. Phrases like "files are automatically deleted after X hours" confirm server-side processing. If the privacy policy mentions no file storage at all, that's either a local-processing tool or an incomplete policy.
2. Check the network traffic
Open your browser's DevTools (F12), go to the Network tab, then load and process a PDF. If you see a large POST or PUT request going to the tool's domain (or a cloud storage URL), your file was uploaded. If the processing happens without any large outbound request, it's local.
3. Try it offline
Load the tool in your browser, then disconnect from Wi-Fi (or use airplane mode). Try to process a PDF. If it fails with a network error, the tool requires server access. If it works, processing is local.
PDF tools that process files locally (no server storage)
PrivaPDF (browser-based, all tools)
PrivaPDF uses WebAssembly to run the entire PDF engine in your browser. Sign, merge, compress, convert, and protect PDFs — all without any file upload. Works offline after initial load.
LibreOffice (desktop app)
Free, open-source office suite that can open, edit, and export PDFs. Completely local — no internet required. Available for Windows, Mac, and Linux.
macOS Preview (Mac only)
Built into macOS. Sign, annotate, and merge PDFs without any server connection. Note: signatures sync to iCloud unless you disable iCloud Drive.
PDF24 Desktop App (Windows)
Free Windows app that processes PDFs locally. The web version does upload files, but the desktop version is fully offline.
PDF tools that do upload your files
These tools are widely used and generally trustworthy for non-sensitive documents — but they do send your files to their servers:
- iLovePDF — files stored on their servers, deleted after a few hours
- Smallpdf — files encrypted in transit and storage, deleted after 1 hour
- Adobe Acrobat online — files processed in Adobe's cloud infrastructure
- PDF2Doc, PDFCandy — various retention policies, server-side processing
What data is in a typical PDF that you might not want stored?
Beyond the visible content, PDFs often contain:
- Metadata: author name, company name, creation date, software used
- Embedded fonts: can reveal organizational software
- Hidden layers: redacted content that isn't truly removed
- Form field data: names, addresses, SSNs in fillable forms
- Annotations and comments: internal review notes
Even a "simple" contract PDF can contain sensitive metadata. A server-side tool receives all of it.
Frequently asked questions
Are browser-based PDF tools slower than server-side tools?
For most operations — merging, compressing, signing — browser-based tools using modern WebAssembly are comparable in speed to server-side tools, especially when you factor in upload and download time. For complex conversions (PDF to Word), server-side tools may have an edge, but local tools have improved significantly.
Can I verify that PrivaPDF doesn't store my files?
Yes. Use your browser's Network tab (F12 → Network) while processing a file. You'll see no outbound requests containing your file data. All network traffic is limited to loading page assets — not your documents.
What about browser extensions that claim to process PDFs locally?
Be cautious with browser extensions. Even if they advertise local processing, extensions have access to all pages you visit and can exfiltrate data. Stick to web tools or desktop apps you can verify.