Filozy

A straight answer

Are online PDF tools safe?

Usually, for ordinary documents. Not reliably, for anything that identifies a person or would cause harm if it leaked. The reason is not that PDF sites are badly run — most are run carefully — but that almost all of them work by taking a copy of your file, and a copy you cannot see is a copy you cannot verify was destroyed.

1. There are two kinds of "online PDF tool", and they are not comparable

This is the distinction the question usually hides, and everything else follows from it.

Server-side — the overwhelming majority
Your file is transmitted to the operator's servers, processed there, and sent back. A readable copy of your document exists on someone else's hardware for as long as that takes, plus however long their retention policy allows. This is how nearly every well-known PDF site works — we measured the best-known ones — and it is not a flaw — it is the only way to offer heavy processing to old browsers and low-powered phones.
Client-side — processed in the browser
The page downloads a processing engine to your device and runs the work there, typically as WebAssembly in a background thread. Your file is opened by your own browser, the same way a desktop application opens it. Nothing is transmitted, so there is no copy to retain, leak or delete.

Both are described as "online tools" because both are websites. The difference is not the interface; it is whether your document leaves the machine you are sitting at.

2. What happens to your file after you upload it

On nearly every free online PDF converter, your file is sent to the operator's server, processed there, sent back, and later deleted on the operator's schedule. The upload often starts sooner than people expect: when we tested the Compress PDF pages of 9 well-known sites on 22 September 2026, every one of them uploaded the file to a server, 8 the moment it was chosen, before any button was pressed. Worth being precise about the rest, because the usual reassurances are technically true and beside the point.

  1. In transit, it is encrypted. HTTPS protects the file on its way across the network. This is real protection, and it is what most sites mean by "secure upload".
  2. On arrival, it is decrypted. It has to be — software cannot compress or convert a document it cannot read. HTTPS ends at the server door.
  3. It exists in plaintext. In memory, and in most architectures on disk, for the duration of the job and usually a while after.
  4. It spreads a little. Not maliciously — this is what production systems do. Files touch temporary directories, queue workers, error reports when a job fails, and any backup snapshot taken while they are present.
  5. It is deleted, on the operator's schedule. Typically one to twenty-four hours.

The weak link is not step 1, which everyone talks about. It is steps 3 to 5, which nobody can show you.

3. What a deletion policy is worth

"Files are permanently deleted after one hour" is the standard promise, and in most cases it is kept. But read what it can and cannot establish.

It establishes an intention, backed by the operator's reputation and, for larger firms, by audits you also cannot see. It does not establish that the storage was overwritten rather than de-referenced, that no backup taken inside the window still holds a copy, that the file never appeared in a log line or a crash report, or that a subcontracted cloud provider's own retention has expired.

None of that makes the operators dishonest. It makes the claim unverifiable, which is a different and more useful thing to know. You are not being offered a risk you can assess. You are being offered one you must accept on trust.

4. When uploading is fine, and when it is not

Refusing to ever upload anything is not good advice; it is just a different way of being unhelpful. The honest answer is that it depends entirely on the document.

Reasonable to upload

  • Documents already public, or destined to be
  • Drafts with no personal or commercial detail
  • Marketing material, agendas, public reports
  • Anything you would email without a second thought

Do not upload

  • Passports, licences, national ID or social security numbers
  • Bank statements, tax returns, payslips
  • Medical records and insurance claims
  • Signed contracts, NDAs, anything covering a third party
  • Unreleased commercial or legal work
  • Anything under GDPR, HIPAA or a client duty — where the upload may itself be a disclosure you are not permitted to make

That last line is the one most often missed. For regulated material the question is not whether the operator is trustworthy. It is whether you were entitled to send the file to a third party at all.

5. How to tell which kind of tool you are using — 30 seconds

You do not have to take anyone's word, including ours. Browsers ship with the instrument that settles it.

  1. Open the PDF site you are considering.
  2. Open developer tools — F12, or Cmd+Option+I on a Mac — and select the Network tab.
  3. Clear the list, so you only see what happens next.
  4. Choose your file and run the job.
  5. Sort the list by size, largest first.

An upload cannot hide. A 4 MB PDF has to cross the network as roughly 4 MB — physics, not policy. It shows up as a POST or PUT whose request body is about the size of your document. If the biggest thing in the list is a few hundred kilobytes of scripts, fonts and a WebAssembly engine, your file stayed where it was.

The harder version: load the page, then disconnect from the internet entirely and run the job again. A client-side tool keeps working, because nothing was happening elsewhere. A server-side one stops. Note one honest caveat — a client-side tool opened for the very first time with no connection will also fail, because it has not yet downloaded its engine. Load it once, then disconnect.

Run this test on any PDF site you are about to trust. It is the same thirty seconds whoever built the page, and it answers the question that the privacy policy only asserts.

6. Questions worth asking of any PDF tool

Where Filozy sits in this

Filozy is a client-side tool: the engine runs in your browser and your document is never transmitted. We would rather you did not take that on faith, since it is exactly the sort of claim every site on this topic makes.

So run section 5 against us. Better, read the page where we set out three checks — including one that uses your browser's developer tools rather than our code, and one that works with the internet switched off. Each says plainly what it proves and what it does not.

One thing we should say against ourselves: Filozy is closed source, so you cannot audit the code. That is a fair reason for scepticism, and it is why every check we point you at is about observable behaviour instead of trust.

Common questions

Is it safe to upload documents to online PDF tools?
For ordinary documents — a meeting agenda, a draft, a public report — a reputable service over HTTPS is a reasonable risk, and millions of people take it daily without consequence. For anything that identifies a person or would matter if it leaked, the calculation changes, because uploading means a readable copy of that document exists on hardware you do not control, and no deletion policy is something you can verify from outside. The safer option for those files is a tool that processes them in your browser, so no copy is ever made.
What happens to my file after I upload it to a free online PDF converter?
The file travels over HTTPS, which protects it in transit, and is then decrypted on the receiving server, because the software cannot edit a file it cannot read. The upload often starts sooner than people expect: on 8 of the 9 well-known sites whose Compress PDF page we tested on 22 September 2026, it began the moment the file was chosen, before any button was pressed. From the moment it arrives there is a plaintext copy of your document in that server's memory and usually on its disk. It is processed, the result is sent back, and the original is deleted according to the operator's policy — commonly one hour to twenty-four hours. Between arrival and deletion the file can appear in backups, logs, error reports and monitoring systems that follow their own retention schedules, and none of that can be checked from outside. A tool that converts in your browser never sends the file anywhere, so none of it applies.
Does "we delete your files after an hour" mean they are gone?
It means the operator intends to remove them on that schedule, and most reputable ones do. It does not mean the bytes are unrecoverable, that no copy reached a backup taken before the deadline, or that the file never appeared in a log or crash report. It is a policy statement, not a technical guarantee, and there is no way to confirm it from the outside — which is the actual problem. You are not being asked to assess a risk; you are being asked to trust one.
How can I tell whether a PDF tool uploads my file or not?
Watch the network rather than reading the marketing. Open your browser's developer tools with F12, select the Network tab, clear it, then run the job. An upload cannot hide: a 4 MB PDF has to cross the network as roughly 4 MB, so it appears as a POST or PUT request with a body about the size of your file. If the largest request is a few hundred kilobytes of scripts and fonts, nothing was uploaded. This test works on any PDF site, and takes about thirty seconds.
Are browser-based PDF tools actually safe, or is that just marketing?
The claim is checkable, which is what separates it from marketing. If processing genuinely happens in the browser, the tool keeps working after you disconnect from the internet, and the Network tab shows no request carrying your file. Both are things you observe rather than believe. Be aware of the weaker version of the claim, though: some sites process in the browser but still send filenames, page counts or crash reports. The network trace shows that too.
Which documents should never be uploaded to an online converter?
Anything identifying: passports, driving licences, national insurance or social security numbers. Anything financial: bank statements, tax returns, payslips. Medical records. Signed contracts and anything under NDA. Unreleased commercial work. Material covered by GDPR, HIPAA or a client confidentiality duty, where the upload itself may be a disclosure you are not permitted to make, regardless of what happens next.