Measured 22 September 2026
Which online PDF tools upload your file? We tested them
Every one of the 9 other online PDF tools we could test uploaded our file to a server — 8 of them the moment it was chosen, before any button was pressed. Before a visitor did anything at all, the typical site loaded 5 advertising or analytics domains and set 18 cookies. We opened each site's Compress PDF page in a fresh browser, touched nothing for fifteen seconds, then gave it a 1.2 MB test PDF, and recorded exactly where that file went. The method and the raw data are below.
The results
| Service | Uploaded the file? | Ad and analytics domains on load | Cookies on load |
|---|---|---|---|
| Filozy | No | 1 | 0 |
| iLovePDF |
Yes
on choosing the file
· api6.ilovepdf.com
|
13 | 54 |
| Smallpdf | Yes on choosing the file · Smallpdf's cloud storage bucket (Cloudflare R2) | 5 | 11 |
| Adobe Acrobat online | Not tested | — | — |
| PDF24 Tools |
Yes
on choosing the file
· filetools24.pdf24.org
|
6 | 16 |
| Sejda |
Yes
on choosing the file
· www.sejda.com
|
0 | 3 |
| Soda PDF |
Yes
on choosing the file
· api-gw.sodapdf.com
|
5 | 20 |
| PDF Candy |
Yes
on choosing the file
· s34.api.pdfcandy.com
|
2 | 6 |
| TinyWow |
Yes
on choosing the file
· tinywow.com
|
36 | 613 |
| CloudConvert |
Yes
after pressing Compress
· eu-central.storage.cloudconvert.com
|
0 | 0 |
| PDF2Go |
Yes
on choosing the file
· www20.pdf2go.com
|
5 | 27 |
| Xodo | Not tested | 7 | 29 |
- Filozy: Its one analytics domain is Cloudflare's cookieless Web Analytics, which sets no cookies. The file never left the browser after Compress was pressed.
- Smallpdf: The file went straight to a cloud storage bucket named smallpdf-production-files, rather than to a Smallpdf server.
- Adobe Acrobat online: Adobe's site refused the automated test browser, so nothing could be measured.
- Sejda: No advertising or analytics domains and three cookies on load, the lightest of the upload-based sites.
- TinyWow: Within 15 seconds of opening, with no interaction, the page made about 7,000 requests to over 400 servers and set 613 cookies. A second measurement the same day found 7,031 requests and 650 cookies from 212 domains.
- CloudConvert: Uploaded only once Compress was pressed, and loaded no advertising or analytics domains and set no cookies beforehand.
- Xodo: The test file was not accepted by the page's picker in our automated run, so no upload result is reported. Xodo's own page says files are "permanently deleted after 1h".
How we measured it
- One visit per site, as a new visitor. A fresh browser profile (Chromium, automated with Playwright), from Canada (Toronto), on 22 September 2026. No account, no cookie consent given, nothing clicked while loading.
- On load. For fifteen seconds after the page opened we recorded every request and every cookie. A service counts as advertising or analytics if its domain belongs to an ad network, analytics, tag manager or session-recording product. The count is of domains, not companies, so one company can appear more than once. Fonts, content delivery, review widgets and error monitoring are third parties but are not counted, and Microsoft's bing.com only where its advertising tag loaded.
- The upload. We gave the page's file picker a 1.2 MB PDF carrying a unique random marker, and pressed the main button if nothing had been sent after fifteen seconds. A small script inside the page inspected everything the page sent — uploads, API calls, beacons — before it left, and recorded an upload only when the body was the test file, a slice of it, or bytes carrying its marker.
- Checked against known answers first. An earlier version that read the network traffic instead got it wrong in both directions, so the method was only trusted once it correctly found the upload on two services known to upload and none on Filozy.
What this does and does not show
- An upload is not misuse. Server-side processing is how most online PDF tools work, and it is what lets them run on any device. It means a copy of your document exists on the operator's servers until it is deleted — see are online PDF tools safe? for when that matters.
- Trackers pay for free tools. Advertising is a normal way to fund a free service. The count shows what loads before you have done anything, which is worth knowing, not a verdict on a company.
- It is one run, on one date, from one place. Sites change, some show different trackers in different countries, and European visitors may see fewer until they accept cookies. Treat these as measurements of what happened, not permanent facts.
- We are not neutral. Filozy makes a browser-based PDF tool, measured here by the same method. Its own page loads one analytics service, Cloudflare's cookieless Web Analytics, and it is counted.
Check any tool yourself, and check us
You do not need our word or anyone's. Open developer tools (F12) → Network, clear it, choose a file, and look for a request about its size. The verification page walks through that and two stronger checks. The full results, including every tracker domain per site, are in the raw data (JSON), free to reuse with credit. Found an error, or a site that has changed? Tell us and we will re-test and correct it.
Common questions
- Which online PDF tools upload your file to a server?
- In our test on 22 September 2026, these uploaded the test file: iLovePDF, Smallpdf, PDF24 Tools, Sejda, Soda PDF, PDF Candy, TinyWow, CloudConvert, PDF2Go. Filozy did not; it processes files in the browser. We recorded an upload only when the file itself, or a piece of it, was sent — detected inside the page before the request left, not inferred from traffic volume.
- Do free PDF websites track you?
- Most do, before you even choose a file. Across the sites we tested, the typical one contacted 5 advertising or analytics domains and set 18 cookies on page load, with no interaction. The most was TinyWow, with 36 such domains and 613 cookies. Advertising is how many free tools are paid for; the test simply makes it visible.
- How can I check whether a PDF tool uploads my file?
- Open developer tools with F12, select the Network tab, clear it and choose a file. An upload shows as a request roughly the size of your file. Then load the tool, turn on airplane mode and run it again: a tool that processes locally still works. It takes about thirty seconds and works on any site.
- Does uploading mean a PDF service is unsafe?
- No. Uploading is how most online PDF tools work, and reputable services encrypt the transfer and delete files within hours. What it does mean is that a copy of your document exists on someone else's servers for a while, which matters for confidential files and not much for ordinary ones.