Someone needs to merge a payslip, a bank statement and a copy of their passport into one file for a rental application. They search for a free PDF merger, click the first result, drag their documents onto the page, and get their merged file thirty seconds later. The whole interaction feels trivial.
What actually happened is that three documents containing their name, address, salary, account number and passport number were transmitted to a company they had never heard of, stored on a server in a country they did not choose, processed, and — according to the terms they did not read — retained for some period they were not told.
This is not a scandal. It is simply how server-based tools work, and most of them are run by reasonable people. But it is worth understanding properly, because the risk is not evenly distributed across documents and there is now a straightforward way to avoid it entirely.
What “upload” actually means
When a website processes your PDF on its server, the sequence is always the same:
- Your browser transmits the complete file over the internet.
- It is written to disk on a machine you have no visibility into.
- A program opens it, does the work, and writes a new file.
- The result is transmitted back to you.
- At some point — minutes, hours, or never — both files are deleted.
Every step in that chain is a place where a copy of your document exists outside your control. During transmission it is encrypted in transit, which protects it from interception but not from the destination. On the server it exists as a plain file that the operator’s systems can read. In backups, it may persist long after the “deleted within one hour” promise has been honoured for the live copy, because backups are taken on their own schedule and are rarely purged selectively.
None of this implies bad faith. It is the unavoidable architecture of processing a file somewhere other than where it lives.
What the policies actually say
Privacy policies for these services are worth reading once, because the pattern is consistent and mildly surprising.
The typical promise is deletion within an hour or two. That is usually sincere for the working copy. What the same documents commonly also contain, in less prominent sections, is a licence to process your content in order to provide the service — necessary and reasonable — permission to retain data for security, abuse prevention or legal compliance, which has no fixed time limit, and a note that processing may occur in other countries where the company or its cloud provider operates.
That last point matters more than it appears. A file uploaded from Kathmandu to a service incorporated in one country, using infrastructure in a second, may be legally reachable by authorities in either. For most documents this is entirely academic. For a client file covered by professional confidentiality, or a document subject to data protection rules about cross-border transfer, it is not.
Free services deserve one extra thought. Running servers that receive and process large files costs real money, and a service with no visible revenue is being paid somehow. Usually it is advertising, which is fine. Occasionally the answer is less comfortable. This is not a reason for paranoia, but it is a reason to prefer tools whose economics you can explain.
The risk depends entirely on the document
Blanket rules are useless here. Almost nobody needs to worry about uploading a restaurant menu.
Low concern. Public documents, marketing material, published papers, anything already on the internet, personal files containing nothing identifying. Upload freely.
Worth thinking about. Anything with your full name plus another identifier: address, date of birth, employer, account number. Bank statements, payslips, utility bills, CVs. Individually mundane, but this is precisely the combination used for identity fraud, and these are the documents most often merged and compressed for applications.
Do not upload. Identity documents — passports, national ID cards, driving licences. Medical records. Signed contracts before they are executed. Anything belonging to a client, patient or employee rather than to you. Anything covered by a confidentiality agreement or professional duty. Financial records for a business other than your own.
For that last category the question is not really about trust. Even a scrupulous service creates a record whose existence you cannot prove or disprove afterwards, and if you are a lawyer, doctor, accountant or HR professional, “I uploaded the client’s file to a free website” is not a sentence you want to have to say.
Browser-based tools are a different thing entirely
Over roughly the last decade, browsers have become capable enough that PDF processing no longer needs a server at all. Reading files, manipulating binary data, rendering pages, generating new documents — all of it can happen in the tab, using your own processor and memory.
When a tool works this way, the file never travels. There is no upload, no server-side copy, no retention policy to trust, no jurisdiction question, and no deletion promise to take on faith. The document is opened by your computer, changed by your computer, and saved by your computer. The website supplied the code and nothing else.
This is not a marketing claim you have to believe. It is verifiable in about twenty seconds, and you should verify it rather than trusting anyone’s word — including this site’s.
How to check for yourself
The network test. Open the tool’s page. Press F12 to open developer tools and select the Network tab. Now process a file. If your document is being uploaded, you will see a request carrying megabytes of data — the size makes it unmistakable. If the tool is browser-based, you will see nothing beyond the page’s own resources, which loaded before you chose a file.
The offline test. This one is even more conclusive and needs no technical knowledge. Load the tool’s page. Turn off your Wi-Fi or unplug the network cable. Now process your file. A server-based tool fails immediately, because it cannot reach its server. A browser-based tool works exactly as normal, because there was never anything to reach. If it works with the internet off, the file cannot possibly be going anywhere.
The speed signal. A 50 MB file takes a genuinely noticeable amount of time to upload on most connections. If a large file is processed apparently instantly, it was not transmitted.
Every tool on this site passes all three tests. So do several other browser-based tools — this is a category, not a unique claim, and you are better served by knowing how to identify one than by taking any particular site’s word for it.
The metadata problem nobody mentions
Even when you have solved the upload question, documents leak information in a quieter way.
Every PDF carries hidden fields: a title, an author, the software that created it, timestamps. The author field is filled in automatically by most software from your computer’s user account, which is why so many documents in circulation are authored by someone’s full legal name, a former colleague, or an IT department’s asset tag. It is visible to anyone who opens the document properties dialogue, and essentially nobody checks it before sending.
Photographs embedded in a PDF can be worse. A phone photo carries EXIF data that may include the device model, the exact time, and — if location services were on — GPS coordinates accurate to a few metres. Photograph a document at home, convert it to PDF, send it to a stranger, and you may have sent them your address.
Checking takes seconds. Open the document properties in any PDF reader, or use a metadata tool to read and clear the fields before sharing. It is the highest-value thirty seconds available in document handling, and almost nobody spends it.
A workable policy
For most people, most of the time:
- Public or trivial documents: use whatever is convenient.
- Personal documents with identifying details: prefer browser-based tools. There is no longer a convenience penalty for doing so.
- Identity documents, client files, medical or legal material: browser-based tools or desktop software only. Never a server-based converter, regardless of its policy.
- Anything you are sending onward: check the metadata first.
The useful shift over the last few years is that privacy no longer costs you anything here. Browser-based tools are not a compromise — they are faster, because nothing is transmitted, and they have no upload limits, because there is no upload. Choosing the private option used to mean choosing the worse option. It does not any more.
Every tool on this site runs in your browser. Try the offline test on Merge PDF — load the page, disconnect, and merge anyway.