Every day, millions of people drag a contract, a bank statement or a medical letter onto a random website to merge, compress or convert it — and most never think about where that file actually goes. Usually nothing bad happens. But “usually” isn’t a security policy, and some free tools genuinely do keep, analyse or leak what you upload. The good news is that you don’t have to guess: with a few simple checks you can tell a trustworthy PDF tool from a risky one in seconds, and for sensitive files there’s an approach that removes the risk almost entirely. Here’s how to stay safe.
The real risks of online PDF tools
Most free PDF sites are fine. The problems come from a minority, and they’re worth naming so you know what you’re avoiding:
- Your file is uploaded to someone else’s computer. With most online tools, “processing” means your document is sent to a server you don’t control. That’s fine for a holiday flyer, less fine for a payslip.
- It may be kept longer than promised. Some services store, cache or even analyse uploads well beyond the moment of conversion — sometimes to train models or build profiles.
- Sketchy sites push malware. A “converter” that asks you to download an .exe or a browser extension to finish the job is a red flag, not a feature. The output of a real tool is just your file.
- Ads and look-alikes. Sites smothered in pop-ups, or ones imitating a well-known brand’s name, are more likely to mishandle your data or trick you into the wrong download.
The other risk: the PDF itself
Choosing a trustworthy website is only half the question. A PDF is not a sheet of paper — it is a container that can hold JavaScript, embedded files, rich-media objects, form actions and links that reach out to the internet. That is why the readers we open PDFs in need patching as often as browsers do, and September 2026 made the point three times over:
- Foxit shipped a large security update on 23 September covering dozens of issues in PDF Reader and PDF Editor — among them code execution through crafted files, attachments and rich media, a flaw that let a PDF trigger silent SMB authentication and leak credential hashes, and a signature-validation bug that could make a document altered after signing still look trustworthy. Safe versions are 2026.2.1 or newer (older Editor lines: 14.0.8 or 13.2.7).
- Chrome’s built-in PDF engine, PDFium, was patched three times in a single month, most recently in Chrome 154 against a use-after-free that a crafted PDF could exploit (CVE-2026-95338; fixed in 154.0.8037.57 and later).
- pdfforge PDF Architect had four memory-corruption flaws published as zero-days in late August with no fix available at the time — a reminder that “there’s an update” is not guaranteed.
None of this means PDFs are dangerous in general; billions open uneventfully every day. It means the common advice “just preview an unknown PDF in your browser” needs one crucial addition: in a fully updated browser. A browser’s PDF viewer is sandboxed and genuinely safer than an outdated desktop reader, but it is not immune.
The trap that isn’t a PDF flaw at all
One of the most effective attacks documented in 2026 used no PDF vulnerability whatsoever. Victims clicked a link, saw a convincing fake PDF page, and were then shown a simulated browser window drawn inside the web page — complete with what looked like Adobe’s own address — offering a “Reader update”. The download installed remote-access software instead. The lesson is simple and worth making a habit: never install a PDF reader update from a page that offers you one. Update through the application’s own built-in update function, or by typing the vendor’s address yourself.
How to tell if a PDF tool is safe
You can judge almost any tool in under a minute. Look for the green flags, and treat the red flags as a reason to close the tab:
The safest option: tools that never upload your file
Here’s the part most guides miss. The strongest privacy protection isn’t a promise to delete your file quickly — it’s never sending the file anywhere in the first place. Modern browsers are powerful enough to merge, split, rotate, convert images and more on your own device, so the document never touches a server. That’s how most of Ream’s tools work: merging, splitting, rotating, images to PDF, PDF to JPG, removing metadata and the rest run in your browser, and the file is never uploaded. You can watch your network activity while you use them — nothing leaves. For anything sensitive, an on-device tool is the safest choice by design, not by policy.
When a tool genuinely needs a server — and how it should behave
Some jobs are too heavy for the browser: converting a Word file with full fidelity, running OCR, deep compression, or repairing a damaged file. When a server is unavoidable, a trustworthy tool is upfront about it and handles the file responsibly. Ream marks those tools with a “Server” badge and, when you use one, the file travels over an encrypted HTTPS connection to a hardened, network-isolated sandbox, is processed, and is deleted immediately afterwards — never stored, never logged, never shared. The honest point is transparency: you should always know whether a job runs on your device or on a server, and what happens to the file either way.
Ask about the copies, not just the file
“We delete your file” is the promise every service makes, and it answers a narrower question than most people realise. Processing a document creates new data: extracted text, thumbnails, search indexes, job records, server logs. A breach at the screenshot service Gyazo in September 2026 made that concrete — alongside account data, the attackers reached roughly 490 million image metadata records that included OCR text extracted from users’ images, upload IP addresses and location data. The original pictures were not the main leak; the machine-readable transcripts of them were, and those can contain everything printed on an invoice, a letter or an ID.
So for anything confidential, the useful questions are: does the service delete the extracted text, thumbnails and metadata as well as the upload? How long do logs keep filenames and job records? Is there a local option that skips the upload entirely? A service that only answers the first question has answered the easy one.
The rule of thumb: for a poster or a public form, any reputable tool is fine. For anything with personal, financial, legal or medical data, prefer a tool that processes on your device — and if you must use a server-side feature, make sure it uses HTTPS and deletes the file right after.
Extra steps for genuinely sensitive documents
Beyond choosing the right tool, a few habits protect the document itself — useful no matter what service you use:
- Remove the sensitive part before sharing. If only a section is confidential — an account number, a name, a signature — redact it so the data is truly gone, not just hidden. Our guide on redacting a PDF the right way explains why a black box on its own isn’t enough.
- Encrypt what you send. A password with Protect PDF means that even if the file ends up in the wrong inbox, it can’t be opened. See protect vs. unlock for the difference between real encryption and weak permission locks.
- Strip hidden metadata. PDFs can carry author names, software details and edit history you didn’t mean to share. Remove Metadata clears it, on your device.
| Check | On-device (browser) tool | Server-side tool |
|---|---|---|
| Is the file uploaded? | No — stays on your device | Yes — sent over HTTPS |
| Best for sensitive files? | Yes | Only if deleted immediately |
| What to verify | That it really runs offline | HTTPS + a deletion promise |
| Typical jobs | Merge, split, rotate, images, metadata | OCR, Office conversion, deep compression |
How Ream is built
We built Ream around exactly this thinking. Most tools run entirely in your browser, so your files never leave your device. The few that need a server run in an isolated sandbox and delete your file the moment they’re done. Everything is served over HTTPS; there are no tracking cookies and no analytics profiling; even the web fonts are self-hosted so nothing is fetched from third parties as you browse. There’s a plain-language privacy policy and a real company behind the site. None of that asks you to take our word for it — it’s the kind of thing the checklist above is designed to verify. For more on locking documents down, see how to really secure a PDF.
Frequently asked questions
Are online PDF tools safe to use? Reputable ones are, for ordinary files. The risk is with unknown sites that retain uploads, drown you in ads, or push downloads. Check for HTTPS, a clear privacy policy and automatic deletion — or use a tool that processes on your device.
What’s the safest way to handle a confidential PDF? Use a tool that works on your device so the file is never uploaded, and redact or encrypt the sensitive parts before sharing.
How do I know if my file was uploaded? If a tool runs in your browser, it works even with your connection briefly off, and you’ll see no upload in your browser’s network tab. Server tools should say so plainly (Ream uses a “Server” badge).
Is it safe if the site uses HTTPS? HTTPS protects the file in transit, which is essential — but it says nothing about what the server does with it afterwards. You still need a clear deletion policy, or on-device processing.
Why does a converter want me to install software? A genuine browser tool never needs an .exe to finish a conversion. Treat that request as a red flag and close the tab.
Do free PDF tools sell my data? Some do, via retained files or tracking. A readable privacy policy and a real company behind the tool are your best signals — Ream keeps no tracking cookies and deletes server-side files immediately.
Can a PDF contain a virus? A PDF can’t infect anything by itself, but it can carry JavaScript, embedded files and actions designed to exploit a flaw in the program that opens it. That’s why reader updates matter: the September 2026 rounds of fixes in Foxit and in Chrome’s PDFium engine closed exactly this class of bug. An up-to-date reader defeats almost all of it.
Is it safer to open an unknown PDF in the browser? Usually yes — browser viewers are sandboxed, so a malicious file has far less to work with than in a desktop reader. But the engine itself gets patched regularly, so this only holds in a browser that is genuinely up to date.
A page says my PDF reader is out of date. Should I install the update? No. Attackers in 2026 built fake PDF pages with a simulated browser window showing a legitimate-looking vendor address, and the “reader update” installed remote-access software. Update only through the application’s own updater or a vendor page you typed yourself.
Does deleting my file mean the service deleted everything? Not necessarily. Conversion and OCR create extracted text, thumbnails, indexes and logs. The Gyazo breach in September 2026 exposed OCR text pulled from users’ images, not just account data. Ask specifically whether derived data is deleted too — or avoid the question by using a tool that never uploads the file.
Safety online isn’t about fear, it’s about a quick habit: glance for HTTPS, a real privacy policy and a deletion promise — and for anything sensitive, prefer a tool that never uploads your file at all. That last point is why Ream runs most of its tools right in your browser, and is honest about the few that don’t.
