Are online PDF and image tools safe? What happens to your file

Whether an online tool is safe for a particular file comes down to one question: does the file leave your device? Many converters and compressors send it to a server, work on it there and send the result back. Others download a program into your browser tab and do the work on your own machine, so no copy exists anywhere else. Both designs are legitimate. They carry different risks, and you do not have to take any site’s word for which one it uses. This guide explains the two designs, shows how to check a site with tools your browser already has, and sets out what ToolsRift does and does not send.

Two ways an online tool can work

	Upload to a server	Process in the browser
Where the work happens	On the operator’s computers	In your browser tab, on your device
What leaves your device	The whole file	Nothing from the file; program code comes down to you
Works with the internet off	No	Yes, once the page and its code have loaded
What you are trusting	The operator’s retention, security and suppliers	The code the page runs, which you can watch

Upload-based tools are the older design: the page is a form and the real software runs in a data centre. A server can run heavy software, handle very large files, and convert formats that no browser library handles well.

Browser-based tools rely on three standard browser features. The File API lets a page read a file only after you hand it over, through a file picker or drag and drop. WebAssembly lets code written in languages such as C, C++ and Rust run in the browser at close to native speed, which is how PDF and image libraries end up inside a web page. Web Workers run that code on a background thread so the page does not freeze. The result is built in your device’s memory and offered to you as a download.

What uploading a file actually risks

None of this means an upload-based service is careless. It means the following become possible.

• Retention. A copy exists on the server until something deletes it. A good service states a short period and keeps to it. Backups, logs and caches can outlive the stated period unless the operator has designed against that.
• Breach. A file that is stored can be exposed if that system is compromised or misconfigured. A file that was never received cannot be.
• Third-party processors. The site you see is rarely the only company involved. Hosting, storage, OCR and AI features are often bought from suppliers, and your file may pass through them.
• Other uses. Terms of service sometimes allow uploaded content to be used to improve the service. Whether that applies is a matter of reading the terms.
• Transit versus rest. HTTPS protects the file on its way to the server. It says nothing about what happens once it arrives.

How much this matters depends on the file. A restaurant menu is not worth a second thought. A passport scan, bank statement, medical letter, payslip or signed contract is.

How to check any site yourself

Test 1: watch the network. Open the tool page, press F12 (or Ctrl+Shift+I, or Cmd+Option+I on a Mac) and choose the Network tab. Click Clear so the list of requests is empty. Now drop your file in and run the tool. An upload shows up as a request, usually marked POST, whose size is close to your file’s size. Click a row and open the Payload tab in Chrome or Edge (the Request tab in Firefox) to see what was sent. If no row is anywhere near the size of your file and no payload contains it, the file was not uploaded during that run.

Test 2: switch the internet off. Let the page load completely. Then turn on airplane mode or disconnect Wi-Fi, or pick Offline from the throttling menu in the Network tab. Run the tool. A server-based tool fails at once. A browser-based tool can still finish, because it has nothing to send. Some load part of their code only on first use, so if one fails, run it once online and repeat the test.

Test 3: read the privacy policy for three things. How long files are kept, who else receives them, and whether they are transferred abroad. Under UK data protection law, the regulator’s guidance lists retention periods, the recipients or categories of recipients, and details of international transfers among the information an organisation must give people. A policy that is silent or vague on all three for uploaded files tells you something.

These tests have limits. They show what a page did this time, not what its code will do next month. A page that passed offline could in principle send data after you reconnect, so leave the Network tab open and look again once you are back online. And they tell you about the website, not about browser extensions or other software on your own device.

How ToolsRift handles your files

The file tools on this site are the browser-based kind. When you drop a PDF or image into one, the page’s code reads it on your device and processes it in a Web Worker using JavaScript or WebAssembly. The result is created in your browser’s memory and handed to you as a download. There is no upload endpoint on ToolsRift: our server has no address that accepts files. The privacy proof page walks through the same two tests using the PDF compressor.

That is not the same as “the site contacts nobody”. Pages do talk to outside services. The privacy proof page lists them by purpose:

Service	Hosts you will see in the Network tab	Why
Google AdSense	pagead2.googlesyndication.com, tpc.googlesyndication.com, googleads.g.doubleclick.net, adservice.google.com and related Google advertising domains	Loads and measures the adverts that pay for the site (content pages only)
Google consent message	fundingchoicesmessages.google.com	Cookie and privacy choices
Google Analytics 4	www.googletagmanager.com, www.google-analytics.com	Usage events
Cloudflare Web Analytics	static.cloudflareinsights.com, cloudflareinsights.com	Cookie-less page views and speed
jsDelivr	cdn.jsdelivr.net	Public code host for a few large libraries that load only when a tool needs them
Hugging Face	huggingface.co and its file hosts	The background-removal model, downloaded to your device and cached
Cloudflare Turnstile	challenges.cloudflare.com	Only if enabled: an anti-spam check on the “Report a problem” form

Adverts and analytics do collect information about your visit. Analytics events record the tool’s name, how long a task took, a coarse size bucket for the input (under 100 KB, 100 KB to 1 MB, 1 to 10 MB, 10 to 100 MB, or over 100 MB) and error codes. They never include file names, file contents or text you type. You control advertising and analytics cookies with “Privacy & cookie settings” in the footer.

A few tools download an extra component the first time you use them. These downloads travel to your device; nothing about your file goes the other way.

Tool	What it fetches on first use	Size
OCR PDF	OCR engine, plus each language you tick	Engine 3.9 MB; English 2.95 MB, Hindi 1.39 MB, Telugu 1.74 MB
HEIC to JPG	HEIC decoder (libheif-js)	1,989,119 bytes
Background remover	Segmentation model	109 MB or 214 MB on devices with WebGPU; 42 MB otherwise

Because of these, the offline test needs one run online first for those tools. PDF tools may also fetch standard font data from the same code host when a document needs it.

Our own database stores only ratings and problem reports. If you rate a tool or send a report, we keep the tool name, your rating or message (up to 500 characters) and the date. To stop repeat ratings we store a one-way hash of your IP address combined with a secret that changes daily; the raw address is not stored. Individual rating events are deleted after 30 days and reports are kept for up to 12 months. As with any website, our host, Cloudflare, also processes the technical details of each request, such as IP address and browser type, to deliver pages and block abuse. The full detail is in the privacy policy.

What stays in your browser. A few small items sit in local storage: your theme, recent and favourite tools, a note that you have rated a tool, and a count of finished tasks. A result passed on to the next tool is held in IndexedDB for up to one hour and deleted as soon as that tool opens it.

How we check ourselves. The site’s test suite includes an automated browser test that runs ten file tools, five PDF and five image, on sample files carrying a marker string. It fails if any outgoing request body contains the marker, or if any POST larger than 2 KB goes to a host other than the advert and analytics ones.

What on-device processing does not protect you from

• Your own device. The output lands in your Downloads folder like any other file, so delete copies you no longer need. Malware, a shared computer or an over-privileged browser extension are outside what any website controls.
• Large files. Each tool reads the whole file into memory, so a PDF of several hundred megabytes can exhaust the tab. A server would not have that limit.
• Misreading what a tool does. Cropping a PDF or removing its metadata does not delete hidden content. Protect PDF encrypts with AES-256, but the print and copy restrictions it sets are requests that other software may ignore.
• Changes over time. This describes the site on the date above. The tests are the lasting safeguard, because they do not depend on our say-so.

A checklist for any online file tool

1. Is the file sensitive? If not, convenience can win.
2. Does the Network tab show a request about the size of your file when you run the tool?
3. Does the tool still work with the internet switched off after the page has loaded?
4. Does the privacy policy state how long uploaded files are kept, in hours or days?
5. Does it name the suppliers or categories of recipients that handle files?
6. Does it say whether files are used for anything beyond your request?
7. Can you use it without an account, so the file is not tied to your identity?

Related tools

• Privacy proof: the two tests, step by step, with the full host list.
• PDF compressor and PDF merger: everyday document jobs, done in the tab.
• Protect PDF: add a password before you email a document.
• OCR PDF: make a scan searchable on your device.
• Image compressor and HEIC to JPG: shrink or convert photos for forms.
• EXIF remover: strip location and camera data before sharing a photo.
• Background remover: runs the model locally after a one-time download.