Short answer: for a menu, a flyer or a school worksheet, uploading to a well-known PDF site is fine. For a tax return, a medical record, a passport scan or a contract under NDA, it's a risk you don't need to take, because the same jobs can be done on your own device. This guide shows what the big services say they do with your files, sorts common documents by risk, and explains how to check whether a tool uploads at all. All of our PDF tools, including Merge PDF and Compress PDF, run in your browser and never send the file anywhere.
The file travels over an encrypted connection to the company's servers, gets processed there, and the result is sent back for you to download. For a while, a copy exists on hardware you don't control. Reputable services delete it on a timer and encrypt it in storage. The risks are the boring ones: a breach during that window, a staff member with access, a subcontractor, or a policy that quietly keeps some files longer than you'd assume.
None of the big names are doing anything shady. The point is just that "deleted after an hour" is a promise you can't check, while "never uploaded" is something you can.
Here's what each service says on its own security pages or help articles, as of October 2026.
| Service | Uploads? | Stated retention | Kept longer when |
|---|---|---|---|
| iLovePDF / iLoveIMG | Yes | Deleted within 2 hours of processing | Signed documents: up to 5 years |
| Smallpdf | Yes | 1 hour | Shared or e-sign files: 14 days; account storage: until you delete |
| PDF24 online | Yes | 1 hour, EU servers | Not stated |
| Sejda Web | Yes | "Deleted after processing", no time given | Not stated |
| TinyPNG (images) | Yes | Up to 48 hours | Not stated |
| Sejda Desktop, PDF24 Creator | No | Never leaves your computer | n/a |
| ToolAspect PDF tools | No | Processed in your browser | n/a |
The "kept longer" column matters more than the headline number. The moment you share a link, request a signature or save to an account, most services switch from automatic deletion to storage.
Think about what a stranger could do with the file, not about how likely a breach is. That gives you a simple rule of thumb.
| Document | What's in it | Worst case if it leaks | Our advice |
|---|---|---|---|
| Tax return, W-2, 1099 | SSN, income, address, bank details | Identity theft, fake tax refund claim | Local only |
| Passport, driver's license scan | Photo, ID number, date of birth | Account takeovers, fake IDs | Local only |
| Medical records, lab results | Diagnoses, insurance numbers | Embarrassment, insurance fraud | Local only |
| Bank or brokerage statement | Account numbers, balances | Targeted phishing, fraud | Local only |
| Contract under NDA | Confidential terms | Breach of the agreement itself | Check the contract, usually local |
| Resume | Name, phone, email, job history | Spam, mild phishing | Either is fine |
| Flyer, menu, public report | Nothing private | None | Use whatever's quickest |
If you work in healthcare or law, the decision may not be yours anyway. US providers covered by HIPAA, for example, generally need a business associate agreement with any vendor that handles patient data, and a free PDF site won't sign one.
Don't rely on the marketing copy, ours included. Two quick checks settle it.
No, and the other two catch more people out than uploads do.
Hidden metadata. PDFs carry an author name, the software used and creation dates, and files exported from Word can carry more. Before you send a document outside your organization, check it with the Document Metadata Remover or edit the fields in the PDF Metadata Editor.
Fake redaction. Drawing a black box over text doesn't delete the text. Anyone can select it and copy it out from underneath. Proper redaction has to remove what's under the box. Our Redact PDF tool does that by turning each page into an image and filling your boxes in solid, so nothing under them survives. The redaction guide walks through it.
Password protection is useful for files you email or store in the cloud, and our password guide covers how. Just don't treat it as a reason to upload, because any tool that edits the PDF has to unlock it first.
Use something that runs on your device. Your browser's built-in PDF viewer can fill forms. Mac Preview can merge, reorder, sign and annotate. Free desktop apps like PDF24 Creator on Windows and LibreOffice Draw cover most of the rest. For quick merges, splits, compression and signatures, a browser tool that doesn't upload gets you the convenience of a website without the copy on someone else's server. Our best free privacy tools roundup lists more of them.
For everyday documents, generally yes. Both use encrypted connections and say they delete files automatically, within two hours for iLovePDF and one hour for Smallpdf. Exceptions apply: iLovePDF keeps signed documents for up to 5 years, and Smallpdf keeps shared or e-signature files for 14 days. For tax, medical or ID documents, use a tool that runs on your device.
It depends on the service. iLovePDF and iLoveIMG say within two hours, Smallpdf and PDF24 say one hour, and Sejda says files are deleted after processing without giving a time. Saving files to an account, sharing a link or sending for signature usually means they're kept longer.
Open your browser's developer tools (F12), go to the Network tab and drop in the PDF. A request about the size of your file means it was uploaded. You can also load the page, turn off Wi-Fi and try the tool. If it still works, the processing is happening on your device.
We wouldn't. A tax return carries your Social Security number, income, address and often bank details, which is everything needed for identity theft or a fraudulent return. Merge, compress or sign it with a desktop app, your browser's built-in PDF viewer or a tool that runs in your browser.
Not really. To merge, compress or convert a protected PDF, the service has to open it, so you'll usually be asked for the password, and the processing happens on unlocked content. Encryption protects a file you email or store. It doesn't stop the tool you hand it to from reading it.