You need to merge a few PDFs, or strip the author name out of a contract before you send it. You search, land on a free web tool, and drop your file into a box. It works — but where did your document just go?
With almost every "online PDF tool," the answer is: to their server. The tool has to receive your bytes before it can process them. For a harmless flyer, that's a non-issue. For a signed contract, a medical record, or anything with someone's personal data on it, it's worth understanding exactly what you just handed over.
What "upload to process" actually means
A typical online PDF tool works like this: your browser sends the file to the provider's server over the network, a process there merges/compresses/edits it, and the result is sent back for you to download. Between those two steps, your document — in full, readable form — exists on a computer you don't control.
That doesn't automatically mean anything bad happens to it. Most providers aren't malicious. But once the file leaves your device, you're trusting a chain of things you can't verify from the browser tab:
- That the provider actually deletes the file afterward, and does so promptly.
- That the server isn't logging uploads, or backing them up somewhere you're not told about.
- That the server itself is never breached, misconfigured, or subpoenaed while your file sits on it.
- That a "free" tool isn't monetizing the content of what you upload.
None of these are things you can check from the outside. You're taking the privacy policy on faith.
The alternative: process the file without sending it anywhere
The other model is client-side (local) processing: the tool runs entirely inside your browser, using the browser's own APIs, and the file never crosses the network. FileX's PDF tools work this way — merging PDFs, stripping metadata, watermarking, and redacting all happen on your machine using pdf-lib, a PDF library that's self-hosted rather than loaded from a third-party CDN.
Concretely, when you merge PDFs in FileX, your browser opens each file, copies its pages into a new document with pdf-lib, and hands you the result as a direct download — there's no server in that path at all. Metadata scrubbing works the same way: it blanks the title, author, subject, keywords, producer, and creation/modification dates in the document properties, then re-saves the file, all without a network request.
This isn't a small implementation detail — it changes what can go wrong. There's no server-side copy to leak, because no copy was ever made anywhere but your own computer.
How to tell if a tool is actually local
You don't have to take a privacy policy's word for it. A few things you can check yourself:
| Signal | What it suggests |
|---|---|
| The tool works with your Wi-Fi off (after the page loads) | Genuinely local — nothing to send |
| Your browser's network tab shows a request containing your file | It's uploading, regardless of what the copy says |
| Processing a huge file is instant | Local — no upload time, no server queue |
| The site requires an account before you can use the tool | Often (not always) a sign files are stored server-side |
FileX makes this checkable rather than a matter of trust: a live monitor on the page tracks bytes uploaded (it stays at 0), and a strict Content-Security-Policy blocks the app from making third-party requests in the first place, so there's no hidden upload path to find. This is the same reasoning covered in more depth in client-side vs. zero-knowledge cloud encryption — the strongest privacy claim isn't a promise, it's an architecture where the upload simply can't happen.
Redaction is a special case — check twice
Redacting a PDF deserves extra scrutiny beyond "was it uploaded." A lot of "redaction" tools just draw a black rectangle on top of the page — the text underneath is often still in the file's content stream, recoverable by copy-pasting or opening the PDF in a different viewer. Real redaction has to remove the underlying content, not just cover it visually. If you're clearing sensitive text from a document, confirm the tool flattens the redacted areas into the export rather than layering a shape over them, on top of confirming it never left your browser to begin with.
When it's fine to upload, and when it isn't
Not every PDF is sensitive, and not every upload is reckless. A public flyer or a document with nothing personal in it carries little risk either way. But for anything you wouldn't want sitting on a stranger's server indefinitely — contracts, ID scans, medical paperwork, financial statements — the safer default is a tool that never asks your file to leave your device in the first place.
Takeaway
- Most online PDF tools require uploading your document to a server, even briefly.
- You can't verify deletion, logging, or breach exposure from the browser — you're trusting a policy.
- Client-side tools remove that trust requirement entirely: the file is merged, cleaned, or redacted on your device, and never transmitted.
- Verify it yourself: check the network tab, or try the tool offline.
Merge, clean, or redact your next PDF without it ever leaving your browser: merge PDF files, remove hidden metadata from a PDF, or redact a PDF — all processed locally, nothing uploaded.