Every online PDF tool starts with the same friendly box: drop your file here. The difference between one site and another is what happens in the half-second after the drop. On some sites the file is read by your browser. On many, it is copied to a server, processed there, and stored for some period that you have to take on trust.
That difference matters because a PDF is rarely just a PDF. It can be a passport scan, a bank statement, a medical letter, a signed contract, or a job application full of personal details. Once the file leaves your device, the question stops being —does this site look trustworthy?— and becomes —where is the copy, who can reach it, and when is it actually deleted?—
An upload is a copy, not a move
When you upload a file, your original stays on your disk. The server gets a second copy. That copy may be encrypted in transit, stored in a bucket, scanned, resized, passed to a worker, written to a temporary directory, and backed up before it is —deleted—. A deletion button in a web interface does not necessarily delete the backups, the logs, or the copy held by a subprocessor.
None of that makes every cloud tool malicious. It means the useful question is not —do they promise to delete it?— but —what is the architecture, and what can I verify?—
Five questions that actually matter
- Where does the processing happen? If the page can work with the network disconnected after it loads, the processing is local. If it fails immediately, the file is going to a server. The Network-tab test settles this in about thirty seconds.
- What is retained, and for how long? —Files are deleted after one hour— is better than nothing, but it is a policy. Ask whether backups, logs, previews or derived files are included. A site that stores nothing has a much simpler answer.
- Who can access the copy? Employees, contractors, subprocessors, support staff and law enforcement can all be in scope depending on the provider and jurisdiction. A small local tool removes most of that list.
- How is it paid for? Storage, bandwidth and processing cost real money. —Unlimited free, no ads, no account— is a business model that needs explaining. The explanation might be a paid tier, a donation box, or a very small static site. It might also be data. Ask which.
- Can you verify the claim? A public architecture note, an offline mode, or a Network-tab demonstration is stronger than a badge that says —military-grade encryption—. Badges are not evidence.
Client-side vs cloud: the honest trade-off
| What matters | Client-side tool | Cloud tool |
|---|---|---|
| Who holds the file | Only you; the bytes stay in the tab | The provider, for however long its policy says |
| Privacy | Strong by architecture | Depends on policy, jurisdiction and security |
| Speed on small files | Immediate; no upload wait | Upload + queue + download |
| Huge files | Limited by your device—s memory | A server farm can handle more |
| Offline use | Possible after the first visit | No |
| Complex features | Limited to what runs in a browser | Can use desktop-class server software |
| Verification | You can watch the network and disconnect | You rely on the provider—s word and audit reports |
The cloud is not automatically worse. A server can run a full office engine, handle a 4 GB video, or provide collaboration that a browser tab cannot. The point is to make the trade knowingly, not to assume a polished interface means a private process.
Red flags worth taking seriously
- A required account before download. If the file has already been processed, the account is usually about tracking, marketing or paywall pressure rather than necessity.
- Vague retention language. —We respect your privacy— is not a retention period. Look for a specific statement about file deletion, backups and logs.
- —Unlimited— with no visible business model. Someone is paying for the storage and bandwidth. It is fair to ask who, and what they get.
- A browser extension that asks for permission on every site. It may be able to read the files you open. That is a much larger permission than a PDF converter needs.
- No HTTPS. In 2026 this should be automatic. A page that loads over plain HTTP can be modified in transit.
- A download that asks you to run an installer. A browser-based converter should produce a file, not an executable.
When uploading is a reasonable choice
There are legitimate cases for a cloud tool: the file is already public, the content is not sensitive, the job is too large for your device, or you need a feature that only server software provides. A press release, a publicly posted form, or a 3 GB video edit is not the same risk as a passport scan.
If you do upload something sensitive, use a provider with a clear retention policy, a reputable security posture, and a jurisdiction you are comfortable with. Delete the file manually if the interface allows it. Do not upload more than the job needs — crop the page, remove the blank pages, redact the account number first.
A practical checklist
- Try the tool with a harmless test file first. Watch the Network tab.
- Disconnect the network after the page loads and try the same operation. Local tools keep working.
- Read the retention sentence, not the privacy badge. Look for a number: hours, days, —never—.
- Check whether the site needs an account to download. Ask why.
- Look for a real contact address and a named person or organisation. —Contact us— with no address is a yellow flag.
- For a sensitive document, prefer a tool that can work offline and has no upload endpoint.
How PocketPDF fits
PocketPDF is built as a static site with no file-upload endpoint. Your browser reads the file, the tool transforms it in memory, and the result is saved as a download. The site can work offline after the first visit because there is no server-side processing step to lose. The privacy policy lists the four local-storage keys, and the security page is explicit about what the architecture does not protect against — a compromised device, a malicious extension, a weak PDF password.
That is not a claim that PocketPDF is perfect. It is a claim that the file-handling question has a short, testable answer. If a site cannot give you one, that is the answer.