Skip to content
LoverPDF

How to check whether a PDF tool uploads your files

Published · 3 min read

“Secure”, “encrypted” and “files deleted after one hour” all sound reassuring, but they describe what happens after your document has been uploaded. The more useful question is whether it gets uploaded at all. Your browser can answer that for you.

Why “secure upload” isn't the whole answer

HTTPS protects your file while it travels. It says nothing about the copy that arrives on the other side: how long it's kept, who can read it, whether it ends up in backups or logs. A tool that never receives the file doesn't have to get any of that right.

Many PDF tasks, such as merging, splitting, reordering, rotating and adding page numbers, can run entirely in the browser. Whether a given site actually does that is something you can observe directly.

The two-minute check

  1. Open the tool's page in Chrome, Edge or Firefox, but don't add a file yet.
  2. Open the developer tools with F12 (Cmd + Option + I on a Mac) and switch to the Network tab.
  3. Clear the list. In Chrome and Edge, tick Preserve log; in Firefox, enable Persist Logs in the settings menu, so nothing disappears if the page navigates.
  4. Now add a PDF of a few megabytes and run the tool all the way to the download.
  5. In the filter box, type method:POST, then try method:PUT as well; both work in Chrome, Edge and Firefox. Click each remaining request and look at its Payload (Chrome, Edge) or Request (Firefox) tab.
  6. An upload is easy to recognise: a request whose body is roughly the size of your file, usually multipart/form-data, often with your file name in it.

Reading the results

  • Entries starting with blob: or data: are your browser passing data around internally. They are not network uploads.
  • Small requests of a few hundred bytes are usually analytics or page-view counters. Open them anyway and check that they don't contain your file name or text from the document.
  • Start recording before you add the file. Some sites upload in the background as soon as you select a file, before you press any button.
  • Check the WS filter too. A site could also send data over a WebSocket connection instead of a normal request.
  • A check shows what happened in that session with that tool. Sites change, and a single site can mix local and server tools, so it's worth knowing which is which.

What you'll see on LoverPDF

Most tools run in your browser: merge, split, organize, rotate, crop, sign, redact, watermark, Protect and Unlock PDF, local compression and many more. With these tools, no request carries your document. Besides Cloudflare's cookie-less page-view beacon, the only requests you'll see are anonymous usage events: the tool name, whether processing was local, a file size range such as 1–5 MB, a duration and an error category. They never include file names, document contents or passwords.

Advanced compression, Word, Excel and PowerPoint to PDF, OCR, PDF to PDF/A, grayscale conversion and Repair PDF need software that doesn't run in a browser, so they use our server. They are labelled “Secure server” before you start, and you will see the upload in the Network tab. Files are deleted as soon as your browser has the result, and at the latest 60 minutes after upload.

We check this ourselves too: our automated test suite includes a test that fails if a local tool sends document bytes over the network.

All articles