Are online PDF tools safe?
Updated October 7, 2026
To merge, compress or sign a PDF, most people search online, open the first site that comes up and upload the file. It helps to know what happens next: if the document is a contract, a medical report or an ID document, there’s one question worth asking before you upload it. Does the file leave your device?
Two ways these tools work
Some PDF tools upload your file to a server, process it there and send back the result. In that case, a copy of the document passes through computers you don’t control and, depending on the service, may be stored there for some time.
Others do the work on your device: your browser downloads the tool’s code and then reads and transforms the file itself. The file doesn’t need to be uploaded: the server only delivers the page and the code.
Neither approach is automatically bad, but only the second one doesn’t require you to trust that the service deletes your file and handles it the way it says.
Three simple tests
- The airplane mode test. Open the tool, go offline (on a phone, turn on airplane mode; on a computer, turn off Wi-Fi and unplug the network cable) and try using it with a file. If it works, the work is done on your device. If it needs an internet connection, the file may be leaving your device, or the tool may still have something to download: check with the next test.
- The “Network” tab. On a computer, open the developer tools (F12; on a Mac, ⌥⌘I) and then the “Network” tab. Process a file and look at the requests that appear at that moment: an upload is a POST or PUT request, and its details show what it sent. The size column only shows what’s received, not what’s sent.
- The privacy policy. Look for where files are processed, how long they’re kept and who has access to them. If this isn’t clear, treat the service as if it keeps your file.
Precautions for any tool
- Before you share a document, cover what doesn’t need to be seen: redact the personal data instead of putting a black box over it.
- Clear the metadata (author, program, dates) with Edit PDF metadata.
- When you send a sensitive document, protect it with a password and send the password another way.
- On a shared computer, close the tab and delete the files from your Downloads folder when you’re done.
- Be wary of sites that ask for an account or an email address for a simple task.
How MovaDoc works
On MovaDoc, the work happens in your browser, in the background, separate from the page. There are no servers that receive files, and the page can only talk to MovaDoc itself. We don’t ask for an account or an email address, and we don’t use advertising or analytics cookies. You can run the three tests above: for example, open Merge PDF, go offline and merge two files.
There are two exceptions, and we’re upfront about them: text recognition (OCR PDF) and the Word and Excel to PDF conversions download the data they need (a few megabytes) from MovaDoc itself the first time you use them. Only the engine and its data are downloaded; your file is never uploaded.
In your browser, MovaDoc stores what you ask it to (for example, your signature, if you choose “Save this signature in this browser”, or your recipes) and a copy of the site itself, so it can work offline. It never stores your files, your results or your passwords. The details are in the privacy policy.
What to check before you upload a sensitive document
- Do I know where the file is processed: on my device or on a server?
- Does it work with the internet turned off?
- Do I know how long it would be kept if it left my device?
- Do I really need to share the whole document, or just part of it?