How to check that a PDF tool doesn't upload your files

Test one: run it with the internet off

A tool that really works on your device keeps working after you cut the connection. There is one catch. Most sites load some of their code the first time you click, so the test needs a warm-up.

1. Open the tool and run it once on a harmless PDF with your internet on.
2. Switch off your Wi-Fi, or turn on airplane mode. Leave the browser tab open.
3. Run the tool again, this time on the file you care about.
4. If you get your result, the work was done on your computer. Nothing can upload a file with no connection.

That proves the processing is local. It does not prove nothing extra is sent while you are online, and the next test covers that. If this one fails, look closer, but do not read it as proof of an upload. The page may just need something it has not loaded yet.

Test two: watch what the page sends

Every major desktop browser has a network monitor built in. In Chrome, Edge and Firefox, press F12, or Ctrl+Shift+I, or Cmd+Option+I on a Mac, and open the Network tab. Safari has a similar tool in its Develop menu. Then run the tool and watch the list fill up.

• Click a request and open the Headers tab. It shows the request method and, among the request headers, Content-Length, which is how much was sent. A file upload is usually a POST or PUT whose Content-Length is close to the size of your file.
• Do not trust the Size column. It shows the size of the answer, not of what you sent, so an upload can look tiny there. Read Content-Length instead.
• Look at where each request goes. A request to an unfamiliar company needs a check. A request to the site itself can still be an upload, so read its Content-Length too.

Here is what you will see on PDFLocal. Running Merge PDFs sends three small POST requests to api.pdflocal.app. One asks how many free runs you have left today. One records that you used a run. One adds one to an anonymous count of which tool ran, with the tool name and your language and nothing else. Other tools send some of these, and a Pro trial adds its own check. Each request is well under a kilobyte, and none contains your file.

A license check for Pro users adds a random device ID and a coarse device signature. Our privacy policy explains both. If you ever see a request as big as your PDF on our site, tell us. That would break our promise, and we want to know.

Test three: read the exact words

Vague wording is a warning sign. "We take your privacy seriously" tells you nothing. Look for a plain statement of where the work happens and how long files are kept, and check that the tool's page and the privacy policy say the same thing. If a site says files are processed in your browser on one page and on its servers on another, believe the more cautious one until they explain.

What these tests cannot show

They show what a page does today, in your browser, with your file. They cannot show what a company does next year, and a page can change between visits. Repeat the checks whenever something important depends on them.

To try it on a tool that should pass, Merge PDFs works with two files, and View Properties is a quick read-only one. For the bigger picture, see whether it is safe to upload a PDF at all.