What happens to your PDF when you use an online tool
Online PDF tools are safe or unsafe for one reason more than any other: whether your file is uploaded. It is fair to ask before merging a contract or compressing a scan of your passport. Here is how these tools are built, how to tell which kind you are using, and what this one cannot promise.
The three ways an online PDF tool can be built
Upload, and process on a server
You choose a file, your browser sends the whole document to the company's machines, their software changes it there, and you download the result.
Your document sits on a computer you do not control, in a form their systems can read. That is not carelessness: text recognition, Office conversion and heavy repair are hard or impossible in a browser, so a server is the only place for them. You cannot see from outside who runs that machine.
Upload, with a promise to delete
The same, plus a stated retention period: files removed after an hour, after a day, or when you close the tab.
This is a real improvement, and most companies that publish such a policy keep it. It is still a promise rather than a mechanism: from your side of the connection there is no way to watch the deletion happen. What protects a contract or a medical letter is that policy.
No upload, because the work happens in your browser
The site sends your browser the code, and your device reads the PDF and writes the new one. The file never leaves the machine.
There is no retention policy to trust, because nothing arrived to be kept. The trade is real: your device does the work, so a large file is limited by your own memory, and anything a browser cannot do is not offered. Nor is the site silent — it still loads its own code.
How to tell which one you are using
This works on any PDF site, including this one, and takes about a minute.
1. Watch the network while the tool runs
Open your browser's developer tools, go to the Network panel and turn on Preserve log. Load the tool page, choose your PDF, and run the job. A tool that uploads shows a request going out roughly the size of your document. A tool that does not shows nothing of the kind.
2. Turn the network off and run the job again
With the page already open, tick Offline in the same panel, then choose a file and run the tool. If it finishes and hands you a result, the work happened on your device.
3. Read the page's own response headers
Click the request for the page itself and read its response headers. The content-security-policy header carries a connect-src list: the only hosts the browser will let that page reach. Anything else the browser blocks.
4. Look at what was left on your device
In the Application or Storage panel, look at Cache Storage, IndexedDB and, in Chrome, the Origin Private File System. A working copy there is expected; what matters is whether you can remove it.
One trap: do not reload after going offline. Some tools that do all their work on your device still fetch their code fresh each time, so the reload fails even though nothing was uploaded.
What PDFCheetah does, and how it is enforced
- Merging, splitting, compressing, organizing, rotating and deleting PDF pages all run in your browser. Your file is read, changed and written back out without a copy going anywhere.
- The page arrives with a policy naming every host it may reach: this site, and the sign-in service the account pages would use. The browser enforces it.
- The five files that do the PDF reading and writing are allowed to open no connections at all.
- An automated check drives all six tools in a real browser, records every request, and fails if your document's bytes or a phrase from inside it turn up in one. One more cannot be published without one: our build fails if any published tool is missing this check.
- Your working copy stays on your device. Every tool page carries a Delete local files control, and anything left is cleared the next time the site starts.
PDFCheetah is not silent. It sends its own server a short usage record: which tool was used, whether the job succeeded, and roughly how long it took. File names and sizes are never included, and the value tying one visit together is random and gone when the tab closes. It is the one outgoing POST in step 1; expanding it shows the whole body.
What this does not cover
- That check compares literal bytes and a planted phrase. A hashed or re-encoded copy of your document would match neither, so it is evidence rather than proof. Step 2 above is the stronger test.
- It drives one ordinary run of each tool. A setting inside a tool that no run reaches is not covered by it.
- The claim covers this application, not your computer. A browser extension that reads pages, other software on the machine, or another person using it, sit outside what a website controls.
- Nothing on your device is encrypted by us. The working copy is ordinary bytes in your browser's storage; only this site can read it, and the delete control removes it.
- Our server sees what any server sees when you load a page: the request, and the address it came from.
- No outside firm has audited this. Everything above is either something your browser shows you or something our own tests check.
If the answer you wanted is that the file stays on your machine, these are the tools that work that way. No account, nothing to upload.