File processing and security

Where file contents go

The tools on this website do not upload the content of your PDF to a server. When you select a file, the tool first checks its name and size and, for suitable files, shows a preview; for this, the browser reads the data into your device's memory. The file is processed only once you start the operation yourself. The browser then provides the output to you as a new file for download; the file you selected is not overwritten. The program code of the tools contains no way to send documents to a server. What you later do with a saved output, such as sending it by email or putting it in a cloud, is your own decision.

Document path and resource path

Your browser still needs a network connection, namely to load the tools' program components. For this, it requests technical resources from the website: pages, stylesheets, scripts, fonts, WebAssembly modules for the actual PDF processing and, for text recognition, additionally its worker, program core and language data for German and English. The request goes from the browser to the website, and the response brings the program components to you. The tools' program code does not include any contents of your file in these requests. Some resources are requested by the browser only when you start an action, for example the compression component or the language data for text recognition. What has already been loaded does not need to be requested again for each step; if a program component is still missing, the browser needs a connection for it. A request for program components at that moment is therefore a download and not an upload of your document.

When compressing, a so-called worker is used. This is a background process within your browser. It receives the file data directly from the open page and processes it with the QPDF library in a virtual file system in memory. It then returns the output. This handover stays within the browser and does not go over the internet. For previews and reading pages, the tools use the PDF.js library. It also works with the data in memory. Images that you convert into a PDF are read locally in the same way.

What the individual steps from selecting to saving look like in the tool is described in the processing workflow.

Preview, download and reset

While you are working with a tool, your file, any preview and the output are held in the browser's memory. For the download, the browser creates an object URL. This is a temporary address that points to the output in memory. It is not a link to the internet and works neither on another device nor after you leave the page.

Releasing here does not mean that every byte is deleted immediately. The website cleans up what it controls itself: on reset, it clears the selection and output, and on reset as well as on leaving the page, it invalidates temporary download links and ends running operations. The browser and operating system then manage the memory themselves, and some browsers keep a page you have left in memory briefly so that it appears faster when you go back. The website therefore cannot promise an exact point in time or complete, secure deletion. There is, however, no retention period on a server for your documents, because the tools never transfer them there in the first place.

What remains permanently are the files you deliberately save. On a device that others also use, it is therefore worth checking the downloads folder. Delete any outputs there that should not be left behind.

Settings and technical resources

The website actually stores two settings on your device, and both only once you make a choice yourself. If you switch between light and dark mode, your browser remembers your choice in localStorage under the name pdf-theme. The code doesn't set an expiry date for it. If you accept or decline optional analytics and advertising services, save your selection or withdraw it, the website also creates the entry pdf-privacy-preferences. It contains your two yes/no decisions on analytics and advertising, a version number, and the times it was saved and expires. After 180 days, or if its content is invalid, it is no longer taken into account until you choose again. Neither entry contains file names or document content.

Analytics and advertising services are currently switched off, even if you consent. No providers are loaded and no data is sent to such services. Beyond that, the code doesn't store anything permanently in your browser: no documents, no results and no history list. While you work, the file and result are held in memory. As with any other website, your browser may cache this website's program files. You can change or withdraw your choice on analytics and advertising via the footer. To remove both entries, delete this site's website data in your browser settings.

Libraries that work in your browser

• QPDF rewrites the PDF when compressing and checks the output. The library runs as a WebAssembly module in its own worker.
• PDF.js displays previews and reads pages. This includes its own worker, WebAssembly parts, fonts and character maps.
• A separate worker for ZIP archives combines several output files, for example exported page images.
• For text recognition, a separate worker starts. It loads its program core and the language data for German and English from the website as needed and does not itself store them permanently in the browser.

These components are part of the website's program package and are loaded into your browser like other resources. They receive your data only within the browser.

Unsupported documents

Some PDFs cannot be rewritten without losing something important. The tools therefore detect certain features before processing. They reject such files instead of delivering an output that is missing something. Which features lead to rejection depends on the tool.

Two points are easily misunderstood. With the page tools, a preview may appear before the file is rejected. Seeing the pages therefore does not mean the file can be edited. Likewise, a number in the upload limit check does not mean the file is suitable for the other tools. The check reads only the size and, where applicable, the page count. It does not check signatures, and it does not clear any file for editing.

None of the tools removes passwords, unlocks protected files or checks whether a digital signature is valid. Encrypted and unreadable are also different cases: an encrypted PDF is deliberately protected. If, on the other hand, a file cannot be read, it may be damaged or incorrectly structured. But it may also use features that the respective tool does not support, or a program component could not be loaded, or the browser did not have enough memory. An error message when reading therefore does not prove that the file is broken.

If your file is rejected

1. Keep the original unchanged. Do not remove a signature or protection just so that a tool accepts the file.
2. For signed documents, first clarify whether you are allowed to submit a modified version at all. If not, ask the issuer for a file of a suitable size.
3. For password-protected files, use an unprotected version only if you are authorized to do so. Otherwise, contact the sender.
4. For forms that the page tools reject, the compressor may be the right route. It automatically compares, among other things, the page count, the number of form fields and the links with the original. However, this count does not show whether fields, calculations and actions still work. So open the saved copy, change a field as a test and check whatever you need for your purpose.

How to tell a signature image, a digital signature and an empty signature field apart is explained in the guide on signatures and forms.

What local processing does and does not prove

Local processing answers one specific question: is your document transferred to a server for processing? For the tools on this website, the answer is no. The information on this page describes the state of the website in October 2026. However, it does not follow that every file, every device and every workflow is secure.

• No virus scan: the tools detect certain document features so that functions are not damaged. They do not search for malware. An accepted file is therefore not considered checked or harmless.
• Your device and your browser: what browser extensions with access to web pages, other programs or other people using the same device can see is outside what the website can control.
• No substitute for redaction: deleting pages, compressing or visible cover-ups do not reliably ensure that confidential or hidden content disappears completely. Text can remain under a black bar, and metadata or embedded content can also remain in the file.
• No legal certification: local processing is a technical property. It is not an assurance under the GDPR (DSGVO) or other requirements.

If you need to permanently remove confidential passages, you need a dedicated workflow for that. Redaction specifically removes visible content. Sanitizing additionally removes hidden data such as metadata, embedded content and scripts. Adobe describes this in its guide to redacting and sanitizing PDFs. For documents from your workplace or organization, the processing route approved there also applies.

Internet connection, browser and website operation

Working without internet

The fact that your document is not uploaded does not mean the tools start without internet. The page and its program components must be loaded first. Some of them, such as workers, WebAssembly modules or fonts, are requested by the browser only when you start an action. A connection may therefore be needed even on a page that is already open before processing begins. The website currently does not offer an offline function that would allow it to be reloaded without a network connection.

Which installed programs work without a network connection and how to check offline use is explained in the guide Compress PDF without upload.

What your browser needs

The tools need an up-to-date browser with JavaScript, Web Workers and WebAssembly enabled. Because processing takes place in memory, large files use a correspondingly large amount of memory. If processing aborts or becomes very slow, it can help to close other tabs or reload the page. Which files and sizes the individual tools accept is described under Supported files and limits.